What is the CVSS score of CVE-2026-56005?

CVE-2026-56005 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Activity Log are affected by CVE-2026-56005?

Melapress WP Activity Log plugin (versions ≤5.6.3.1) contains a stored/reflected XSS vulnerability exploitable by any Subscriber-level user, allowing injection of scripts that execute in other users'…

How to fix or mitigate CVE-2026-56005?

24 hours: Identify all WordPress installations running Melapress WP Activity Log and document version numbers. 7 days: Disable Subscriber account self-registration (require manual admin approval), restrict Subscriber user role access to WP Activity Log plugin via user capability filters, or disable the plugin entirely until vendor releases a patch. 30 days: Monitor vendor advisory channels for patch release; upon availability, test in staging environment and deploy to all production sites after validation.

WP Activity Log CVE-2026-56005

EUVD-2026-39374 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Patchstack

GHSA-fr34-xvr7-v6g8

WordPress XSS Wp Activity Log Wordpress Plugin Melapress

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable web app (AV:N), low complexity (AC:L); the 'Subscriber' requirement implies authentication so PR:L not PR:N; an admin must view the log (UI:R) and the XSS crosses into the admin context (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:21 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in Melapress's WP Activity Log WordPress plugin (versions <= 5.6.3.1, reported by Patchstack) lets a low-privileged Subscriber-level user inject script that executes in another user's browser, with a CVSS-rated scope change (S:C) meaning the payload can affect resources beyond the plugin's own security context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; direct impact is limited (C:L/I:L/A:L) but the cross-context scope and low attack complexity make it relevant for sites that allow open registration.

Technical ContextAI

The affected component is WP Activity Log (formerly WP Security Audit Log; CPE cpe:2.3:a:melapress:wp_activity_log:*:*:*:*:*:*:*:*), a widely-used WordPress audit-logging plugin that records user and site activity into an admin-facing event log. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input is rendered into a page without sufficient output encoding or input sanitization. Because the plugin's purpose is to capture and later display user-generated activity data in the administrator's log viewer, a Subscriber can plant a script payload that is stored and subsequently executed when a higher-privileged user (e.g., an administrator) views the log - consistent with the CVSS scope change (S:C) where the vulnerable component and the impacted component differ.

RemediationAI

Update WP Activity Log to a release later than 5.6.3.1 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-3-1-cross-site-scripting-xss-vulnerability); no exact patched version number is independently confirmed from the available data, so verify the fixed version directly with the vendor (Melapress) before relying on it. As compensating controls until patched: disable open user self-registration (Settings > General, uncheck 'Anyone can register') so untrusted Subscriber accounts cannot be created - the trade-off is blocking legitimate self-signup; restrict and audit existing Subscriber-level accounts; and consider a WAF or virtual patch (Patchstack provides one) to filter XSS payloads against the plugin's logging endpoints, accepting possible false positives on legitimate activity data. Administrators should also minimize viewing the activity log in a privileged session while unpatched.