# cve.now: Melapress

The newest entries naming Melapress as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121573](https://cve.now/CVE-2026-121573.md): WordPress WP Activity Log plugin \<= 5.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-109900](https://cve.now/CVE-2026-109900.md): WordPress Melapress Role Editor plugin \<= 1.3.0 - Privilege Escalation vulnerability (CVSS 9.6)
- [CVE-2026-109899](https://cve.now/CVE-2026-109899.md): WordPress Melapress Role Editor plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2026-120075](https://cve.now/CVE-2026-120075.md): WP Activity Log \<= 5.6.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2026-62142](https://cve.now/CVE-2026-62142.md): WordPress WP 2FA plugin \<= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- [CVE-2026-96827](https://cve.now/CVE-2026-96827.md): WordPress Admin Notices Manager plugin \<= 1.6.0 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-62085](https://cve.now/CVE-2026-62085.md): WordPress WP Activity Log plugin \<= 5.6.6 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-65512](https://cve.now/CVE-2026-65512.md): WordPress WP Activity Log and WP Activity Log Premium plugins \<= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-56005](https://cve.now/CVE-2026-56005.md): WordPress WP Activity Log plugin \<= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-54806](https://cve.now/CVE-2026-54806.md): WordPress WP Activity Log plugin \<= 5.6.3.1 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-45435](https://cve.now/CVE-2026-45435.md): WordPress WP Activity Log plugin \<= 5.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-25331](https://cve.now/CVE-2026-25331.md): WordPress WP Activity Log plugin \<= 5.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-14866](https://cve.now/CVE-2025-14866.md): Melapress Role Editor \<= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment (CVSS 8.8)
- [CVE-2025-6895](https://cve.now/CVE-2025-6895.md): MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get\_valid\_user\_based\_on\_token Function (CVSS 9.8)
- [CVE-2025-3702](https://cve.now/CVE-2025-3702.md): WordPress Melapress File Monitor plugin \< 2.2.0 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-39565](https://cve.now/CVE-2025-39565.md): WordPress MelaPress Login Security plugin \<= 2.1.0 - PHP Object Injection Vulnerability (CVSS 6.6)
- [CVE-2025-2876](https://cve.now/CVE-2025-2876.md): MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion (CVSS 5.3)
- [CVE-2025-0767](https://cve.now/CVE-2025-0767.md): WP Activity Log 5.3.2 - Insecure deserialization (CVSS 6.3)
- [CVE-2025-0924](https://cve.now/CVE-2025-0924.md): WP Activity Log \<= 5.2.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-10793](https://cve.now/CVE-2024-10793.md): WP Activity Log \<= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User\_id Parameter (CVSS 7.2)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-35650](https://cve.now/CVE-2024-35650.md): WordPress MelaPress Login Security plugin \<= 1.3.0 - Remote File Inclusion vulnerability (CVSS 4.9)
- [CVE-2024-1717](https://cve.now/CVE-2024-1717.md): Admin Notices Manager \<= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval (CVSS 4.3)
- [CVE-2024-32568](https://cve.now/CVE-2024-32568.md): WordPress WP 2FA plugin \<= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2022-44595](https://cve.now/CVE-2022-44595.md): WordPress WP2FA plugin \<= 2.2.0 - Broken Authentication vulnerability (CVSS 5.3)
- [CVE-2023-50905](https://cve.now/CVE-2023-50905.md): WordPress WP Activity Log Plugin \<= 4.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-6506](https://cve.now/CVE-2023-6506.md): WP 2FA \<= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending (CVSS 4.3)
- [CVE-2023-6520](https://cve.now/CVE-2023-6520.md): WP 2FA – Two-factor authentication for WordPress \<= 2.5.0 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2023-2261](https://cve.now/CVE-2023-2261.md): WP Activity Log \<= 4.5.0 - Missing Capabilities Check to User Enumeration (CVSS 4.3)
- [CVE-2023-2286](https://cve.now/CVE-2023-2286.md): WP Activity Log \<= 4.5.0 - Cross-Site Request Forgery via ajax\_run\_cleanup (CVSS 4.3)
- [CVE-2020-36716](https://cve.now/CVE-2020-36716.md): WP Activity Log \<= 4.0.1 - Missing Authorization (CVSS 7.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/melapress
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.