CVE-2026-45435: medium-severity vulnerability in Melapress WP Activity Log
WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
35Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendcvss 6.5epss 0.2%
from disclosure to weapon
Published on NVDMay 25
VulnCheck+141d
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.
This issue affects WP Activity Log: from n/a through 5.6.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
Melapress · WP Activity LogRelated CVEs — Melapress WP Activity Log
In the same product, most dangerous first.
CVE-2026-54806CRITICALWordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerabilityEPSS 0.7%CVE-2025-0767MEDIUMWP Activity Log 5.3.2 - Insecure deserializationEPSS 0.5%CVE-2023-50905HIGHWordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-62085HIGHWordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-56005HIGHWordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-25331MEDIUMWordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%