Melapress develops a focused line of WordPress security and monitoring plugins, including activity logging, two-factor authentication, file monitoring, and login protection tools that extend a widely adopted content-management platform. The recurring vulnerability classes—cross-site scripting, SQL injection, deserialization flaws, authorization bypasses, and cross-site request forgery—reflect the WordPress plugin environment's dependence on proper input handling, secure data serialization, and access-control enforcement within a shared administrative interface. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Melapress over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-54806CRITICAL Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | Jun 17, 2026 | 9.8 | 35 | NO | NO |
CVE-2025-6895CRITICAL The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in version | Jul 26, 2025 | 9.8 | 35 | NO | NO |
CVE-2024-2018HIGH The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escap | Apr 9, 2024 | 8.8 | 33 | NO | NO |
CVE-2026-56005HIGH Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions. | Jun 25, 2026 | 7.1 | 32 | NO | NO |
CVE-2025-0767CRITICAL WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php. | Feb 27, 2025 | 9.8 | 30 | NO | NO |
CVE-2026-65512MEDIUM Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions. | Jul 23, 2026 | 5.4 | 25 | NO | NO |
CVE-2026-45435MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.
This issue affects WP Activit | May 25, 2026 | 6.5 | 24 | NO | NO |
CVE-2025-2876HIGH The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor | Apr 8, 2025 | 8.2 | 23 | NO | NO |
CVE-2025-0924MEDIUM The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient in | Feb 17, 2025 | 6.1 | 22 | NO | NO |
CVE-2026-25331MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issu | Feb 19, 2026 | 6.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Melapress.
Media articles that mention a CVE ID that affects a product developed by Melapress — matched by CVE ID, not by vendor name.