CVE-2025-0924highCWE-79

CVE-2025-0924: high-severity vulnerability in melapress WP Activity Log

WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor WP Activity Log

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 1.4%
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
melapress · WP Activity Log
Related CVEs — melapress WP Activity Log

In the same product, most dangerous first.

CVE-2024-10793HIGHWP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id ParameterEPSS 1.5%CVE-2020-36716HIGHWP Activity Log <= 4.0.1 - Missing AuthorizationEPSS 0.8%CVE-2023-2261MEDIUMWP Activity Log <= 4.5.0 - Missing Capabilities Check to User EnumerationEPSS 0.6%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2023-2286MEDIUMWP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanupEPSS 0.3%CVE-2026-120075HIGHWP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%