What is the CVSS score of CVE-2026-45435?

CVE-2026-45435 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WP Activity Log CVE-2026-45435

EUVD-2026-31764 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 Patchstack

GHSA-vx32-gc9p-9pfp

XSS Wp Activity Log

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:51 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.

This issue affects WP Activity Log: from n/a through 5.6.3.

AnalysisAI

DOM-Based Cross-Site Scripting in Melapress WP Activity Log (all versions through 5.6.3) allows a low-privileged, authenticated attacker to inject malicious scripts into the browser DOM of a victim who interacts with crafted content, with scope impact extending beyond the plugin itself. The CVSS vector (PR:L/UI:R/S:C) indicates exploitation requires an existing WordPress account and victim interaction, but the changed scope means successful exploitation can compromise the victim's browser session across the broader WordPress environment. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (10th percentile) signals low observed exploitation probability.

Technical ContextAI

WP Activity Log is a WordPress audit-log plugin by Melapress (CPE: cpe:2.3:a:melapress:wp_activity_log:*:*:*:*:*:*:*:*) that records and displays user activity events within the WordPress admin interface. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in its DOM-Based XSS variant, meaning unsanitized attacker-controlled data is written directly into the browser DOM via client-side JavaScript - the server never sees or sanitizes the payload. This is distinct from reflected or stored XSS and is typically harder to detect with server-side WAF rules. Because the plugin renders activity log data in the WordPress admin panel, an attacker with contributor-level or higher access may be able to inject payloads that execute in the context of higher-privileged admin sessions when those admins view the activity log.

RemediationAI

Update WP Activity Log to the version released after 5.6.3; the exact patched version is not independently confirmed from the available reference data - verify the current release at the WordPress plugin repository or the Melapress vendor page and apply the latest available version. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-3-cross-site-scripting-xss-vulnerability should be consulted for vendor-confirmed fix version details. As a compensating control where patching is temporarily delayed, restrict access to the WP Activity Log admin interface to trusted administrator accounts only, and audit which low-privilege roles (contributor, author, subscriber) are active on the site - removing unnecessary accounts limits the attacker pool. Note that a WAF rule targeting DOM-Based XSS payloads may offer limited protection since the injection occurs client-side; server-side filtering alone will not fully mitigate DOM XSS.