melapress has 5 CVEs on record. 4 were published in the last 90 days. The median CVSS is 7.6 (high). None have a confirmed exploitation report. Most affected products: wp-security-audit-log (2), WP Activity Log (1), admin-notices-manager (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.6
- Publish → KEV
- —
- Last 90 days
- 4 prev 1
Products
- wp-security-audit-log 2
- WP Activity Log 1
- admin-notices-manager 1
- wp-2fa 1
Worst active — by depth score
CVE-2026-62142High· 8.8Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.48CVE-2026-96827High· 7.6Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.42CVE-2026-62085High· 7.6Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.42CVE-2026-120075High· 7.2WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting40CVE-2026-56005High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.39
melapress vulnerabilities
CVEs affecting melapress, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-120075High· 7.2WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated atta…
CVE-2026-62142High· 8.8Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
CVE-2026-62085High· 7.6Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
CVE-2026-96827High· 7.6Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
CVE-2026-56005High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.