WordPress plugin vulnerabilities
WP Activity Log vulnerabilities
Known security issues in the WP Activity Log WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.
- Plugin slug
- wp-security-audit-log
- Latest version
- 5.6.7
- Active installs
- 300,000+
- Known vulnerabilities
- 34
- Data updated
- 2026-10-18 09:00 UTC
Check your version
This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.
Fixed in version 5.6.7 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log <= 5.6.6 - Authenticated (Administrator+) SQL Injection CVE-2026-62085 · Source | High | 7.6 | < 5.6.7 | 2026-07-23 |
Fixed in version 5.6.5 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log <= 5.6.4 - Cross-Site Request Forgery CVE-2026-65512 · Source | Medium | 5.4 | < 5.6.5 | 2026-06-19 |
Fixed in version 5.6.4 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection CVE-2026-54806 · Source | Critical | 9.8 | < 5.6.4 | 2026-06-16 |
| WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-56005 · Source | High | 7.1 | < 5.6.4 | 2026-06-19 |
Fixed in version 5.6.3.1 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2026-45435 · Source | Medium | 6.5 | < 5.6.3.1 | 2026-05-19 |
Fixed in version 5.6.0 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-25331 · Source | Medium | 6.5 | < 5.6.0 | 2026-02-14 |
Fixed in version 5.3.3 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log 5.3.2 - Insecure deserialization CVE-2025-0767 · Source | Critical | 9.8 | < 5.3.3 | 0000-00-00 |
Fixed in version 5.3.0 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting CVE-2025-0924 · Source | Medium | 6.1 | < 5.3.0 | 0000-00-00 |
Fixed in version 5.2.2 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Activity Log Plugin <= 5.2.1 is vulnerable to Cross Site Scripting (XSS) CVE-2024-10793 · Source | High | 7.2 | < 5.2.2 | 2024-11-14 |
Fixed in version 4.6.2 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-50905 · Source | High | 7.1 | < 4.6.2 | 2024-02-14 |
Fixed in version 4.5.2 (5)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Security Audit Log < 4.0.2 - Broken Access Control in First-Time Install Wizard CVE-2020-36716 · Source | High | 7.3 | < 4.5.2 | 2020-03-08 |
| WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup CVE-2023-2286 · Source | Medium | 4.3 | < 4.5.2 | 2023-05-17 |
| WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db CVE-2023-2285 · Source | Medium | 4.3 | < 4.5.2 | 2023-05-17 |
| WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db CVE-2023-2284 · Source | Medium | 4.3 | < 4.5.2 | 2023-05-17 |
| WordPress WP Activity Log Plugin < 4.5.2 is vulnerable to Sensitive Data Exposure CVE-2023-2261 · Source | Medium | 4.3 | < 4.5.2 | 2023-05-17 |
Fixed in version 4.4.3 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Activity Log Plugin <= 4.4.2.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-33999 · Source | High | 7.1 | < 4.4.3 | 2023-07-18 |
Fixed in version 4.4.0 (4)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 · Source | Medium | 6.3 | < 4.4.0 | 2022-03-04 |
| WordPress WP Activity Log plugin < 4.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source | Not rated | - | < 4.4.0 | 2022-02-28 |
| WordPress WP Activity Log plugin < 4.4.0 - Sensitive Information Disclosure vulnerability No CVE assigned · Source | Not rated | - | < 4.4.0 | 2022-02-28 |
| Unauthorised AJAX Calls via Freemius No CVE assigned · Source | Not rated | - | < 4.4.0 | - |
Fixed in version 4.1.5 (3)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Activity Log plugin <= 4.1.4 - SQL Injection (SQLi) in External Database Module vulnerability No CVE assigned · Source | Not rated | - | < 4.1.5 | 2020-11-14 |
| WP Activity Log <= 4.1.4 - SQL Injection No CVE assigned · Source | Not rated | - | < 4.1.5 | 2020-11-04 |
| WP Activity Log < 4.1.5 - SQL Injection in External Database Module No CVE assigned · Source | Not rated | - | < 4.1.5 | - |
Fixed in version 4.0.2 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Activity Log Plugin <= 4.0.1 is vulnerable to Broken Access Control No CVE assigned · Source | Not rated | - | < 4.0.2 | 2023-03-08 |
| WordPress WP Security Audit Log plugin <= 4.0.1 - Broken Access Control vulnerability No CVE assigned · Source | Not rated | - | < 4.0.2 | 2020-03-08 |
Fixed in version 3.3.1.2 (3)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Security Audit Log <=3.3.1.1 - Authenticated Option Update vulnerability (Fremius Library security issue) No CVE assigned · Source | Not rated | - | < 3.3.1.2 | 2019-03-02 |
| Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update No CVE assigned · Source | Not rated | - | < 3.3.1.2 | 2019-02-25 |
| Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update No CVE assigned · Source | Not rated | - | < 3.3.1.2 | - |
Fixed in version 3.1.2 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Security Audit Log plugin <=3.1.1 - Sensitive Information Disclosure CVE-2018-8719 · Source | Medium | 5.3 | < 3.1.2 | 2018-03-28 |
Fixed in version 2.4.4 (2)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WordPress WP Security Audit Log plugin <= 2.4.3 - Reflected Cross-Site Scripting (XSS) Vulnerability No CVE assigned · Source | Not rated | - | < 2.4.4 | 2017-06-27 |
| WordPress Security Audit Log Plugin <= 2.4.3 - Cross Site Scripting No CVE assigned · Source | Not rated | - | < 2.4.4 | 2016-06-27 |
Fixed in version 1.2.5 (1)
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log <= 1.2.4 - Cross-Site Request Forgery CVE-2014-5072 · Source | High | 8.8 | < 1.2.5 | 2014-08-01 |
Affects version 2.4.3 and earlier (2)
The source does not state the fixed version; versions after this one are not listed as affected.
| Vulnerability | Severity | CVSS | Affected versions | Published |
|---|---|---|---|---|
| WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting No CVE assigned · Source | Not rated | - | >= 1.5 and <= 2.4.3 | 2016-06-27 |
| WP Security Audit Log 1.5-2.4.3 - Authenticated Reflected Cross-Site Scripting (XSS) No CVE assigned · Source | Not rated | - | >= 1.5 and <= 2.4.3 | - |
Check every plugin on your site automatically
Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.
Sources and attribution
- Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
- CVE records are copyright The MITRE Corporation. CVE Terms of Use.
- Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
- Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.