CVE-2026-45435
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WP Activity Log plugin up to version 5.6.3 is vulnerable to DOM-based XSS due to improper input neutralization during page generation.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session or data theft.
Recommendation
It is recommended to update the WP Activity Log plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in WP Activity Log
See all- CVE-2026-62085High
The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.
- CVE-2026-54806Critical
The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.
- CVE-2026-56005High
Stored XSS vulnerability in the WP Activity Log plugin by Melapress. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 5.6.3.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS