WP Activity Log CVE-2026-56005

Exploitation requires WP Activity Log installed at version <= 5.6.3.1 and the attacker being able to submit data that the plugin logs and later renders to a viewer. Per the title this requires a Subscriber-level account, which in turn requires the target site to allow user registration - however, the supplied CVSS vector states PR:N (no authentication), a discrepancy that must be confirmed with the Patchstack advisory. The principal limiting factor is UI:R: the payload only fires when a higher-privileged user (typically an administrator) opens the activity log to view the malicious entry, so exploitation is not fully automatic and depends on victim interaction. Sites that disable self-registration and tightly control low-privilege accounts substantially reduce exposure.

Signals are mixed-to-moderate. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) indicates network-reachable, low-complexity exploitation requiring user interaction, with a scope change but only Low impact to confidentiality, integrity, and availability. There is a notable conflict: the title and CWE context describe this as a 'Subscriber' XSS (implying an authenticated Subscriber account is needed), yet the supplied vector carries PR:N (no privileges) - this should be verified against the Patchstack advisory, as it materially changes risk. No EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public proof-of-concept was supplied. Net: a real but mid-tier priority - meaningful for multi-user WordPress sites with open registration where a Subscriber can target an admin, but not an emergency mass-exploitation scenario. The 7.1 is driven largely by the scope change rather than by severe direct impact.

On a WordPress site that permits open registration, an attacker registers a Subscriber account and performs an action whose attacker-controlled data (e.g., a crafted profile field, request parameter, or other logged value) is captured by WP Activity Log without proper encoding. When an administrator later opens the activity log to review events, the stored script executes in the admin's authenticated browser session and can perform actions as that admin. No public PoC was provided, but the low attack complexity (AC:L) and required victim interaction (UI:R) make the scenario straightforward.