Melapress vulnerabilities
31 CVEs and advisories name Melapress as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121573WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-109900WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability
- CVE-2026-109899WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability
- CVE-2026-120075WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-62142WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-96827WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability
- CVE-2026-62085WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability
- CVE-2026-65512WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-56005WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54806WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability
- CVE-2026-45435WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25331WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-14866Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment
- CVE-2025-6895MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function
- CVE-2025-3702WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerability
- CVE-2025-39565WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerability
- CVE-2025-2876MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion
- CVE-2025-0767WP Activity Log 5.3.2 - Insecure deserialization
- CVE-2025-0924WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-10793WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks
- CVE-2024-35650WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability
- CVE-2024-1717Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
- CVE-2024-32568WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2022-44595WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability
- CVE-2023-50905WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-6506WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending
- CVE-2023-6520WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery
- CVE-2023-2261WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration
- CVE-2023-2286WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup