WP Activity Log vulnerabilities

The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.

The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.

Stored XSS vulnerability in the WP Activity Log plugin by Melapress. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 5.6.3.1.

The WP Activity Log plugin up to version 5.6.3 is vulnerable to DOM-based XSS due to improper input neutralization during page generation.