CVE-2026-62085
HighCVSS 7.6Summary
The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.
Risk Assessment
Risk of data leakage, modification, or deletion in the database, as well as privilege escalation.
Recommendation
Update the WP Activity Log plugin to the latest version that includes the fix.
Other vulnerabilities in WP Activity Log
See all- CVE-2026-54806Critical
The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.
- CVE-2026-56005High
Stored XSS vulnerability in the WP Activity Log plugin by Melapress. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 5.6.3.1.
- CVE-2026-45435Medium
The WP Activity Log plugin up to version 5.6.3 is vulnerable to DOM-based XSS due to improper input neutralization during page generation.
Original NVD description (English source)
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS