CVE-2017-15867

Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, (3) user_id, (4) username, (5) country_name, (6) browser, (7) operating_system, or (8) ip_address parameter to admin/partials/listing/listing.php.

• CWE-79

• https://github.com/faiyazalam/WordPress-plugin-user-login-history/commit/519341a7dece59e2c589b908a636e6cf12a61741Patch, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8939Third Party Advisory
• https://github.com/faiyazalam/WordPress-plugin-user-login-history/commit/519341a7dece59e2c589b908a636e6cf12a61741Patch, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8939Third Party Advisory

Published

Oct 24, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15860In all Qualcomm products with Android releases from CAF usin…
• CVE-2017-15861In all Qualcomm products with Android releases from CAF usin…
• CVE-2017-15862In all Qualcomm products with Android releases from CAF usin…
• CVE-2017-15863Cross Site Scripting (XSS) exists in the wp-noexternallinks …
• CVE-2017-15864In the Agent Frontend in Open Ticket Request System (OTRS) 3…
• CVE-2017-15865bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, a…
• CVE-2017-15868The bnep_add_connection function in net/bluetooth/bnep/core.…7.8
• CVE-2017-15869Cross-site scripting (XSS) vulnerability in knowledgebase.ph…
• CVE-2017-15870Palo Alto Networks GlobalProtect Agent before 4.0.3 allows a…
• CVE-2017-15871The deserialize function in serialize-to-js through 1.1.1 al…7.5
• CVE-2017-15872phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmp…
• CVE-2017-15873The get_next_block function in archival/libarchive/decompres…5.5