Skip to content
OpenAdvisories

Product · melapress

WP Activity Log

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.2
    CVE-2026-120075

    WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting

    The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitr…

    melapress WP Activity Log Web / CMS
  • High 7.6
    CVE-2026-62085

    WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

    Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

    melapress WP Activity Log
  • High 7.1
    CVE-2026-56005

    WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.

    melapress WP Activity Log
  • High 7.2
    CVE-2025-0924 Public exploit

    WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

    The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

    melapress WP Activity Log Web / CMS
  • High 7.2
    CVE-2024-10793 Public exploit

    WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter

    The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated …

    melapress WP Activity Log Web / CMS
  • High 7.1
    CVE-2023-50905

    WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1.

    melapress WP Activity Log
  • High 7.3
    CVE-2020-36716

    WP Activity Log <= 4.0.1 - Missing Authorization

    The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (…

    melapress WP Activity Log Web / CMS