Melapress
30 CVEs across 14 Melapress products. Browse Melapress vulnerabilities, severities, and proof-of-concept exploits.
Melapress products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-96827 | High | 7.6 | 2026-09-30 | Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. |
CVE-2026-62085 | High | 7.6 | 2026-09-30 | Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. |
CVE-2026-65512 | Medium | 5.4 | 2026-07-23 | Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This iss… |
CVE-2026-56005 | High | 7.1 | 2026-06-25 | Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions. |
CVE-2026-54806 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. |
CVE-2026-45435 | Medium | 6.5 | 2026-05-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This iss… |
CVE-2026-25331 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DO… |
CVE-2025-14866 | High | 8.8 | 2026-01-23 | The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigure… |
CVE-2025-6895 | Critical | 9.8 | 2025-07-26 | The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token(… |
CVE-2025-3702 | Medium | 5.4 | 2025-07-03 | Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2024-9879 | Medium | 5.4 | 2025-05-15 | The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perfor… |
CVE-2024-10009 | Medium | 4.1 | 2025-05-15 | The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perfor… |
CVE-2025-39565 | Medium | 6.6 | 2025-04-16 | Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaP… |
CVE-2025-2876 | Medium | 5.3 | 2025-04-08 | The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability… |
CVE-2025-0767 | Critical | 9.8 | 2025-02-27 | WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer… |
CVE-2025-0924 | High | 7.2 | 2025-02-17 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 d… |
CVE-2024-10793 | High | 7.2 | 2024-11-15 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due… |
CVE-2022-4974 | Medium | 6.3 | 2024-10-16 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to… |
CVE-2022-44587 | Medium | 5.3 | 2024-06-21 | Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP… |
CVE-2024-35650 | Medium | 4.9 | 2024-06-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security mel… |
CVE-2024-1717 | Medium | 4.3 | 2024-06-04 | The Admin Notices Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_ajax_call() functio… |
CVE-2024-32568 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA wp-2fa.This issue affects WP 2FA: from n… |
CVE-2024-2018 | High | 8.8 | 2024-04-09 | The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due… |
CVE-2022-44595 | Medium | 5.3 | 2024-03-21 | Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0. |
CVE-2023-50905 | High | 7.1 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue af… |
CVE-2023-6520 | Medium | 4.3 | 2024-01-11 | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5… |
CVE-2023-6506 | Medium | 4.3 | 2024-01-11 | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2023-2286 | Medium | 4.3 | 2023-06-09 | The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonc… |
CVE-2023-2261 | Medium | 4.3 | 2023-06-09 | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call function in versions u… |
CVE-2020-36716 | High | 7.3 | 2023-06-07 | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to… |