CVE-2026-45435

MediumCVSS 6.5

Published: 25/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The WP Activity Log plugin up to version 5.6.3 is vulnerable to DOM-based XSS due to improper input neutralization during page generation.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session or data theft.

Recommendation

It is recommended to update the WP Activity Log plugin to the latest version that fixes this vulnerability.

Other vulnerabilities in WP Activity Log

See all

CVE-2026-56005High
The WP Activity Log plugin versions up to 5.6.3.1 contain a Cross Site Scripting (XSS) vulnerability that can be exploited by subscribers.
CVE-2026-54806Critical
The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3.