CVE-2020-36716: high-severity vulnerability in melapress WP Activity Log
WP Activity Log <= 4.0.1 - Missing Authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.8%
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
melapress · WP Activity LogRelated CVEs — melapress WP Activity Log
In the same product, most dangerous first.
CVE-2024-10793HIGHWP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id ParameterEPSS 1.5%CVE-2025-0924HIGHWP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.4%CVE-2023-2261MEDIUMWP Activity Log <= 4.5.0 - Missing Capabilities Check to User EnumerationEPSS 0.6%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2023-2286MEDIUMWP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanupEPSS 0.3%CVE-2026-120075HIGHWP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%