TI-2025-00653 CVE-2025-0767 · GHSA-7crf-mwwj-hvjp
WP Activity Log 5.3.2 - Insecure deserialization
Priority LOW 28
WP Activity Log 5.3.2 was found to be vulnerable.
Vulnerabilities
5 records
TI-2025-00784 CVE-2025-0924 · GHSA-gqj7-345q-xx3j
WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting
Priority MEDIUM 40
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping.
TI-2024-10005 CVE-2024-10793 · GHSA-8ffc-p9g9-p8qm
WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
Priority MEDIUM 41
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping.
TI-2024-01878 CVE-2024-2018 · GHSA-87q7-rp2h-q5xw
WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injection
Priority MEDIUM 42
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and l…
TI-2023-27808 CVE-2023-50905 · GHSA-p86v-jh7g-5x8q
WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)
Priority MEDIUM 64
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1.