CVE-2026-120075: WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting

Q: Which sites are exposed?

WordPress sites running WP Activity Log version 5.6.1 or earlier are affected.

Q: Does an attacker need an account or user interaction to inject malicious content?

No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction for injection.

Q: When would an injected script run?

The injected script executes when a user accesses a page containing the malicious stored content.

Published Oct 31, 2026

Updated

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Event History

Oct 31, 2026

CVE Published

via MITRE·08:30 AM

Data Sourced

via MITRE·08:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed?

WordPress sites running WP Activity Log version 5.6.1 or earlier are affected.

Does an attacker need an account or user interaction to inject malicious content?

No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction for injection.

When would an injected script run?

The injected script executes when a user accesses a page containing the malicious stored content.

CVE-2026-120075: WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting

Event History

Frequently Asked Questions

Which sites are exposed?

Does an attacker need an account or user interaction to inject malicious content?

When would an injected script run?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed?

Does an attacker need an account or user interaction to inject malicious content?

When would an injected script run?