CVE-2026-56005
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Stored XSS vulnerability in the WP Activity Log plugin by Melapress. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 5.6.3.1.
Risk Assessment
A malicious script can be executed in the administrator's browser, potentially leading to session hijacking, data theft, or unauthorized actions in the WordPress admin panel.
Recommendation
Update the WP Activity Log plugin to a version newer than 5.6.3.1. Also check logs and content for suspicious injections.
Other vulnerabilities in WP Activity Log
See all- CVE-2026-62085High
The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.
- CVE-2026-54806Critical
The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.
- CVE-2026-45435Medium
The WP Activity Log plugin up to version 5.6.3 is vulnerable to DOM-based XSS due to improper input neutralization during page generation.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS