CVE-2026-121573: WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Q: What access and interaction are required to exploit this issue?

The vulnerability is reachable over the network and has low attack complexity, but the attacker needs low-level privileges and a user must interact with the malicious content. The impact can extend beyond the initial security authority scope.

Q: Which plugin versions are affected?

WP Activity Log versions through 5.6.7 are affected. The provided data does not identify a fixed version.

Q: What is the potential impact of successful exploitation?

This is a stored XSS issue. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.

Affected Software

1 affected component

Melapress WP Activity Log<=5.6.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WP Activity Log plugin to a version that resolves this vulnerability.
Fixed in 5.6.8

Event History

Nov 9, 2026

CVE Published

via MITRE·06:09 PM

Data Sourced

via MITRE·06:09 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access and interaction are required to exploit this issue?

The vulnerability is reachable over the network and has low attack complexity, but the attacker needs low-level privileges and a user must interact with the malicious content. The impact can extend beyond the initial security authority scope.

Which plugin versions are affected?

WP Activity Log versions through 5.6.7 are affected. The provided data does not identify a fixed version.

What is the potential impact of successful exploitation?

This is a stored XSS issue. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.

CVE-2026-121573: WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Which plugin versions are affected?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Which plugin versions are affected?

What is the potential impact of successful exploitation?