Executive brief
WP Activity Log is a popular WordPress plugin used by administrators to track and audit changes made to their websites. A security vulnerability in this plugin could allow an attacker with basic user access to inject malicious scripts into the site's administrative interface. If a site administrator interacts with these scripts, it could lead to unauthorized actions, data theft, or complete site takeover.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Melapress WP Activity Log plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation, specifically within the Document Object Model (DOM) environment. An attacker with 'Subscriber' level privileges or higher can inject malicious payloads that execute in the context of a more privileged user's session (such as an administrator) when they interact with a crafted page or link. This is classified as CWE-79 and has been addressed in version 5.6.3.1.
Affected products
- Melapress WP Activity Log through 5.6.3
Timeline
- 2026-04-30: other: Vulnerability reported by researcher daroo
- 2026-05-19: advisory: Initial advisory published by Patchstack
- 2026-05-25: disclosed: CVE published to NVD
- 2026-05-19: patched: Version 5.6.3.1 released to address the issue