CVEs we hold for Melapress
Records whose assigning authority named Melapress as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-65512WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerabilityMelapress WP Activity Log Premium
CVE-2026-56005WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerabilityMelapress WP Activity Log
CVE-2026-54806WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerabilityMelapress WP Activity Log
CVE-2026-45435WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerabilityMelapress WP Activity Log
CVE-2026-25331WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerabilityMelapress WP Activity Log
CVE-2025-6895MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via…Melapress Login Security
CVE-2025-39565WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection VulnerabilityMelaPress Login Security
CVE-2025-3702WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerabilityMelapress File Monitor
CVE-2025-2876MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated…MelaPress Login Security
CVE-2025-14866Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via…Melapress Role Editor
CVE-2025-0924WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scriptingmelapress WP Activity Log
CVE-2024-9879Website File Changes < 2.1.1 - Authenticated SQL InjectionUnknown Melapress File Monitor
CVE-2024-35650WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerabilityMelaPress Login Security
CVE-2024-32568WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityMelapress WP 2FA
CVE-2024-1717Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrievalmelapress Admin Notices Manager
CVE-2024-10793WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parametermelapress WP Activity Log
CVE-2024-10009Website File Changes < 2.1.0 - Admin+ Authenticated SQL InjectionUnknown Melapress File Monitor
CVE-2023-6520WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgerymelapress WP 2FA – Two-factor authentication for WordPress
CVE-2023-6506WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sendingmelapress WP 2FA – Two-factor authentication for WordPress
CVE-2023-50905WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)Melapress WP Activity Log
CVE-2023-2286WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanupmelapress WP Activity Log; wpwhitesecurity WP Activity Log…
CVE-2023-2261WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumerationmelapress WP Activity Log; wpwhitesecurity WP Activity Log…
25 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.