CVE-2024-10793 is a stored cross-site scripting vulnerability (CWE-79) in the WP Activity Log plugin for WordPress, affecting all versions up to 5.2.1. The issue is caused by improper neutralization of input in the user_id parameter, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of administrative users when they access the injected page, potentially leading to session hijacking or other client-side impacts. The vulnerability is remotely exploitable without authentication and has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). No official patch or vendor advisory is referenced in the provided data.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of administrative users, potentially compromising confidentiality and integrity of administrative sessions. The vulnerability does not impact availability. There are no known exploits in the wild as per the current data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access and consider applying web application firewall (WAF) rules to detect and block malicious input targeting the user_id parameter. Avoid accessing suspicious or untrusted pages that may contain injected scripts.