Cross-site Scripting Vulnerability in Melapress WP Activity Log by WordPress
CVE-2026-25331

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WP Activity Log
Vendor
CVE Published:
19 February 2026

What is CVE-2026-25331?

The vulnerability in Melapress WP Activity Log allows for improper neutralization of input during web page generation, leading to a DOM-based Cross-site Scripting (XSS) issue. This exposure makes the plugin susceptible to injecting malicious scripts into web pages viewed by users, potentially compromising sensitive user data and application integrity. Affected versions of the WP Activity Log plugin include all versions up to and including 5.5.4, emphasizing the need for prompt updates and security measures.

Affected Version(s)

WP Activity Log 0 <= 5.5.4

References

https://patchstack.com/database/Wordpress/Plugin/wp-secur...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Steven Julian | Patchstack Bug Bounty Program
.