EIP-2026-113527

The writeup details a stored XSS vulnerability in the WordPress Activity Log plugin (version 2.3.1) via the X-Forwarded-For header, which is insufficiently sanitized and rendered in the Activity Log page. The proof of concept demonstrates the injection of a malicious script that executes when an admin views the log.