CVE-2023-2761: Solwininfotech User Activity Log

High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days.

The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.

Affected products

• Solwininfotech User Activity Log: before 1.6.3 (fixed in 1.6.3)

Published 2023-07-24. Last modified 2026-06-17.