GCVE - cpe:2.3:a:melapress:wp_activity_log:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:melapress:wp_activity_log:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Melapress (`7b16c59f-5102-5265-b499-38ab78b79b40`)
Product	Wp Activity Log (`2709b678-d4fd-5767-8164-0ba89431c5c8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/melapress/wp-security-audit-log`	purl2cpe	2026-06-01 10:17:56.131633

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-45435`	vulnerable	2026-06-08 08:05:11.759997	WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3. Published: 2026-05-25T22:28:19.614Z Updated: 2026-05-26T15:19:10.629Z Open on db.gcve.eu Reference links https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-25331`	vulnerable	2026-06-08 07:53:19.656094	WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4. Published: 2026-02-19T08:26:57.085Z Updated: 2026-04-28T16:14:55.538Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-0924`	vulnerable	2026-06-08 07:02:25.979595	WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting HIGH (7.2) The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-02-17T04:22:45.608Z Updated: 2026-04-08T17:09:15.144Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/91699d32-1768-4d87-a4f2-91969b3e3355?source=cve https://wordpress.org/plugins/wp-security-audit-log/#developers https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Controllers/class-alert-manager.php https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Controllers/class-alert.php https://plugins.trac.wordpress.org/changeset/3238760/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-0767`	vulnerable	2026-06-08 07:02:25.519691	WP Activity Log 5.3.2 - Insecure deserialization WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php. Published: 2025-02-27T18:14:52.946Z Updated: 2025-02-27T19:00:33.746Z Open on db.gcve.eu Reference links https://fluidattacks.com/advisories/skims-9/ https://co.wordpress.org/plugins/wp-security-audit-log/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10793`	vulnerable	2026-06-08 06:23:47.561420	WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter HIGH (7.2) The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page. Published: 2024-11-15T05:30:56.843Z Updated: 2026-04-08T16:49:29.220Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/44f3b2e4-c537-4369-b2d6-39fbc6cb8e08?source=cve https://plugins.trac.wordpress.org/browser/wp-security-audit-log/tags/5.2.1/classes/WPSensors/class-wp-system-sensor.php#L679	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-50905`	vulnerable	2026-06-08 06:16:16.989058	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2286`	vulnerable	2026-06-08 06:02:41.827146	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2261`	vulnerable	2026-06-08 06:02:41.710574	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4974`	vulnerable	2026-06-08 05:52:02.642000	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-36716`	vulnerable	2026-06-08 05:25:49.457564	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.