Melapress

Wp Activity Log

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2026-54806

  • EPSS 0.59%
  • Veröffentlicht 17.06.2026 09:51:45
  • Zuletzt bearbeitet 17.06.2026 09:51:45

Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

6.5

CVE-2026-45435

  • EPSS 0.2%
  • Veröffentlicht 25.05.2026 22:28:19
  • Zuletzt bearbeitet 26.05.2026 19:31:20

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3.

6.5

CVE-2026-25331

  • EPSS 0.16%
  • Veröffentlicht 19.02.2026 08:26:57
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4.

9.8

CVE-2025-0767

  • EPSS 0.43%
  • Veröffentlicht 27.02.2025 19:15:49
  • Zuletzt bearbeitet 21.05.2025 17:06:08

WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.

6.1

CVE-2025-0924

  • EPSS 1.27%
  • Veröffentlicht 17.02.2025 05:15:09
  • Zuletzt bearbeitet 23.05.2025 17:41:46

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unaut...

6.1

CVE-2024-10793

  • EPSS 1.29%
  • Veröffentlicht 15.11.2024 06:15:04
  • Zuletzt bearbeitet 19.11.2024 21:13:22

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthe...

8.8

CVE-2024-2018

  • EPSS 0.88%
  • Veröffentlicht 09.04.2024 19:15:24
  • Zuletzt bearbeitet 08.04.2026 17:18:28

The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation ...

6.1

CVE-2023-50905

  • EPSS 0.33%
  • Veröffentlicht 29.02.2024 06:15:45
  • Zuletzt bearbeitet 28.04.2026 19:22:41

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1.