GCVE - cpe:2.3:a:melapress:wp_activity_log:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:melapress:wp_activity_log:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Melapress (`7b16c59f-5102-5265-b499-38ab78b79b40`)
Product	Wp Activity Log (`2709b678-d4fd-5767-8164-0ba89431c5c8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/melapress/wp-security-audit-log`	purl2cpe	2026-06-01 10:17:56.131633

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-65512`	vulnerable	2026-07-29 01:06:20.111212	WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability MEDIUM (5.4) Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4. Published: 2026-07-23T11:19:09.110Z Updated: 2026-08-05T08:36:51.179Z Open on db.gcve.eu Reference links https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve https://patchstack.com/database/WordPress/Plugin/wp-security-audit-log-premium/vulnerability/wordpress-wp-activity-log-premium-plugin-5-6-4-cross-site-request-forgery-csrf-vulnerability	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-56005`	vulnerable	2026-07-29 01:00:28.715093	WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability HIGH (7.1) Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions. Published: 2026-06-25T13:12:37.530Z Updated: 2026-06-25T14:19:35.839Z Open on db.gcve.eu Reference links https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-45435`	vulnerable	2026-06-08 08:05:11.759997	WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3. Published: 2026-05-25T22:28:19.614Z Updated: 2026-05-26T15:19:10.629Z Open on db.gcve.eu Reference links https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-25331`	vulnerable	2026-06-08 07:53:19.656094	WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4. Published: 2026-02-19T08:26:57.085Z Updated: 2026-04-28T16:14:55.538Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-0924`	vulnerable	2026-06-08 07:02:25.979595	WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting HIGH (7.2) The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-02-17T04:22:45.608Z Updated: 2026-04-08T17:09:15.144Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/91699d32-1768-4d87-a4f2-91969b3e3355?source=cve https://wordpress.org/plugins/wp-security-audit-log/#developers https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Controllers/class-alert-manager.php https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Controllers/class-alert.php https://plugins.trac.wordpress.org/changeset/3238760/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-0767`	vulnerable	2026-06-08 07:02:25.519691	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10793`	vulnerable	2026-06-08 06:23:47.561420	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-50905`	vulnerable	2026-06-08 06:16:16.989058	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2286`	vulnerable	2026-06-08 06:02:41.827146	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2261`	vulnerable	2026-06-08 06:02:41.710574	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4974`	vulnerable	2026-06-08 05:52:02.642000	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-36716`	vulnerable	2026-06-08 05:25:49.457564	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.