Advisories · Technology

melapress WP Activity Log.

Every CVE that names melapress WP Activity Log among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120075 CVE record

CVSS 7.2 High

WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
- melapress WP Activity Log
- Cross-site scripting (XSS)
Not analysed yet 31 Oct 2026
CVE-2026-62085 CVE record

CVSS 7.6 High

WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability
- Melapress WP Activity Log
- SQL injection
Not analysed yet 30 Sept 2026
CVE-2026-65512 CVE record

CVSS 5.4 Medium

WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
- Melapress WP Activity Log
- Melapress WP Activity Log Premium
- Cross-site request forgery (CSRF)
Not analysed yet 23 Jul 2026
CVE-2026-56005 CVE record

CVSS 7.1 High

WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability
- Melapress WP Activity Log
- Cross-site scripting (XSS)
Not analysed yet 25 Jun 2026
CVE-2026-54806 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability
- Melapress WP Activity Log
- Insecure deserialization
Not analysed yet 17 Jun 2026
CVE-2026-45435 CVE record

CVSS 6.5 Medium

WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability
- Melapress WP Activity Log
- Cross-site scripting (XSS)
Not analysed yet 25 May 2026
CVE-2026-25331 CVE record

CVSS 6.5 Medium

WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability
- Melapress WP Activity Log
- Cross-site scripting (XSS)
Not analysed yet 19 Feb 2026
CVE-2025-0767 CVE record

CVSS 6.3 Medium

WP Activity Log 5.3.2 - Insecure deserialization
- Melapress WP Activity Log
- Insecure deserialization
Not analysed yet 27 Feb 2025
CVE-2025-0924 CVE record

CVSS 7.2 High

WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting
- melapress WP Activity Log
- Cross-site scripting (XSS)
Not analysed yet 17 Feb 2025
CVE-2024-10793 CVE record

CVSS 7.2 High

WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
- melapress WP Activity Log
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2023-50905 CVE record

CVSS 7.1 High

WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)
- Melapress WP Activity Log
- Cross-site scripting (XSS)
Not analysed yet 29 Feb 2024
CVE-2023-2261 CVE record

CVSS 4.3 Medium

WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration
- melapress WP Activity Log
- wpwhitesecurity WP Activity Log Premium
- Broken access control
Not analysed yet 9 Jun 2023
CVE-2023-2286 CVE record

CVSS 4.3 Medium

WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup
- melapress WP Activity Log
- wpwhitesecurity WP Activity Log Premium
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jun 2023
CVE-2020-36716 CVE record

CVSS 7.3 High

WP Activity Log <= 4.0.1 - Missing Authorization
- melapress WP Activity Log
- Broken access control
Not analysed yet 7 Jun 2023