Log in Start free

Melapress

Products

ProductCVEsExploitedLatest
WP Activity Log14–Oct 31, 2026
MelaPress Login Security4–Jul 26, 2025
WP 2FA3–Oct 8, 2026
WP 2FA – Two-factor authentication for WordPress2–Jan 11, 2024
Admin Notices Manager2–Sep 30, 2026
WP Activity Log Premium1–Jul 23, 2026
Melapress File Monitor1–Jul 3, 2025
MelaPress Login Security Premium1–Apr 8, 2025
Melapress Role Editor1–Jan 23, 2026

Exploited and recent CVEs

  • CVE-2026-120075 High 7.2 WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting 0.2%
  • CVE-2026-62142 High 8.8 WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-96827 High 7.6 WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability 0.3%
  • CVE-2026-62085 High 7.6 WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability 0.3%
  • CVE-2026-65512 Medium 5.4 WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-65512 Medium 5.4 WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-56005 High 7.1 WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-54806 Critical 9.8 WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability 0.7%
  • CVE-2026-45435 Medium 6.5 WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-25331 Medium 6.5 WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-14866 High 8.8 Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment 0.4%
  • CVE-2025-6895 Critical 9.8 MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function 0.8%
  • CVE-2025-3702 Medium 5.4 WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerability 0.3%
  • CVE-2025-39565 Medium 6.6 WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerability 0.9%
  • CVE-2025-2876 Medium 5.3 MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion 0.4%
  • CVE-2025-2876 Medium 5.3 MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion 0.4%
  • CVE-2025-0767 Medium 6.3 WP Activity Log 5.3.2 - Insecure deserialization 0.5%
  • CVE-2025-0924 High 7.2 WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting 1.4%
  • CVE-2024-10793 High 7.2 WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter 1.5%
  • CVE-2024-35650 Medium 4.9 WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability 0.6%
  • CVE-2024-1717 Medium 4.3 Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval 0.4%
  • CVE-2024-32568 High 7.1 WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2022-44595 Medium 5.3 WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability 0.5%
  • CVE-2023-50905 High 7.1 WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS) 0.3%
  • CVE-2023-6506 Medium 4.3 WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending 0.5%
  • CVE-2023-6520 Medium 4.3 WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery 0.2%
  • CVE-2023-2261 Medium 4.3 WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration 0.6%
  • CVE-2023-2286 Medium 4.3 WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup 0.3%
  • CVE-2020-36716 High 7.3 WP Activity Log <= 4.0.1 - Missing Authorization 0.8%