CVE-2023-3435

9.8 criticalEPSS 1.0%

Critical (9.8) in solwininfotech user activity log. EPSS 1.0% chance of exploitation in the next 30 days.

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
Published: 2023-08-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

solwininfotech:user_activity_log

References

https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b
https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b

Check your stack JSON