CVE-2026-25331

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4.

Score

CVSS 3.1 6.5 Medium

Status

Deferred - audit@patchstack.com

Published

2026-02-19

Last modified

2026-04-28

Weaknesses

CWE-79

Affected products

• Wp Activity Log (Melapress)

References

• https://patchstack.com/database/Wordpress/Plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5…