Plugins · user-activity-log · data as of 2026-11-04
Is User Activity Log safe? Known vulnerabilities and latest version
- Status
- Closed 2025-12-29
- Known issues on record
- 8
- Unpatched in latest
- 0
What to do
- Replace it. A closed plugin gets no updates through WordPress, so any hole found from now on stays open.
- Deactivate and delete it once you have a replacement (Plugins → Deactivate → Delete). Deleting removes its files; deactivating alone leaves them on the server.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan, or have us clean it: Emergency Cleanup, $499.
With WP-CLI, once you have a replacement: wp plugin deactivate user-activity-log && wp plugin delete user-activity-log
Check your version
Known vulnerabilities
8 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. 8 record(s) do not state which versions are affected.
medium 5.3 CVE-2025-13471 · published 2026-01-28
Security issue in User Activity Log (2.2 and older)
- Affected
- 2.2 and older
- Fixed in
- unknown
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
high 7.5 CVE-2025-11877 · published 2026-01-07
Missing authorization check in User Activity Log (2.2 and older)
- Affected
- 2.2 and older
- Fixed in
- unknown
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.
high 7.6 CVE-2024-31356 · published 2024-04-10
SQL injection in User Activity Log (1.8 and older)
- Affected
- 1.8 and older
- Fixed in
- unknown
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.
critical 9.8 CVE-2023-37966 · published 2023-10-31
SQL injection in User Activity Log (1.6.2 and older)
- Affected
- 1.6.2 and older
- Fixed in
- 1.6.3
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through 1.6.2.
medium 4.3 CVE-2023-4269 · published 2023-09-04
Missing authorization check in User Activity Log (older than 1.6.6)
- Affected
- older than 1.6.6
- Fixed in
- 1.6.6
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
high 7.5 CVE-2023-4279 · published 2023-09-04
Security issue in User Activity Log (older than 1.6.7)
- Affected
- older than 1.6.7
- Fixed in
- 1.6.7
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
critical 9.8 CVE-2023-3435 · published 2023-08-14
SQL injection in User Activity Log (older than 1.6.5)
- Affected
- older than 1.6.5
- Fixed in
- 1.6.5
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
high 7.2 CVE-2023-2761 · published 2023-07-24
SQL injection in User Activity Log (older than 1.6.3)
- Affected
- older than 1.6.3
- Fixed in
- 1.6.3
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Recent activity
- 2025-12-29 — closed on wordpress.org (Security Issue).
- 2026-01-28 — Security issue disclosed (CVE-2025-13471), fix version not stated.
- 2026-01-07 — Missing authorization check disclosed (CVE-2025-11877), fix version not stated.
- 2024-04-10 — SQL injection disclosed (CVE-2024-31356), fix version not stated.
Get an email when User Activity Log has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for User Activity Log (user-activity-log) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
Types found in this plugin: SQL injection (4) · Missing authorization (2)
Where this data comes from
- Version, last update, installs, closure: wordpress.org/plugins/user-activity-log (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/user-activity-log"><img src="https://laskyr.com/plugins/user-activity-log/badge.svg" alt="User Activity Log vulnerability status"></a>