User Login History
Monthly
SQL injection in the User Login History WordPress plugin (all versions ≤2.1.7) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'blog_id' parameter, exposing the full WordPress database to read access. The vulnerability is constrained to WordPress multisite deployments and requires Administrator-level credentials, limiting its real-world attack surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis; a code-level fix appears to have been committed upstream per the plugin repository changeset.
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SQL injection in the User Login History WordPress plugin (all versions ≤2.1.7) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'blog_id' parameter, exposing the full WordPress database to read access. The vulnerability is constrained to WordPress multisite deployments and requires Administrator-level credentials, limiting its real-world attack surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis; a code-level fix appears to have been committed upstream per the plugin repository changeset.
Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.