{"id":"CVE-2026-121573","kind":"vulnerability","aliases":["CVE-2026-121573"],"related":[],"title":"WP Activity Log: stored XSS through 5.6.7 lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.","summary":"WP Activity Log, a WordPress plugin by Melapress, has a stored cross-site scripting flaw in versions through 5.6.7. An attacker can plant script that runs in the browser of anyone who views the affected log page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-activity-log"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/wp-security-audit-log/`\n- Look for `WP Activity Log` version `5.6.7` or earlier","fix":null,"status":"open","published_at":"2026-11-09T19:16:45+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:31:51+00:00","updated_at":"2026-11-09T19:31:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T19:31:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Activity Log: stored XSS through 5.6.7 lets attackers run scripts","impact":"medium","summary":"WP Activity Log, a WordPress plugin by Melapress, has a stored cross-site scripting flaw in versions through 5.6.7. An attacker can plant script that runs in the browser of anyone who views the affected log page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-activity-log","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in admin browsers, enabling session or account takeover","analyst_note":"Confirm the fixed version and required privilege from the NVD entry or the Melapress advisory; the sources give only the affected range.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/wp-security-audit-log/`\n- Look for `WP Activity Log` version `5.6.7` or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Activity Log (wp-security-audit-log) WordPress plugin at version 5.6.7 or earlier are affected. The sources do not say which user roles can inject the stored script, or whether a fixed version exists.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4551,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121573':14A,17A '-2026':13A,16A '5.6.7':7A,46B,99C 'activ':2A,25B,28B,81C,94C 'affect':62B,92C 'allow':88C 'anyon':58B 'attack':9A,48B 'audit':86C 'browser':56B 'cross':39B,74C 'cross-sit':38B,73C 'cve':12A,15A 'flaw':42B 'generat':72C 'host':21B 'improp':65C 'input':68C 'issu':91C 'let':8A 'log':3A,26B,29B,63B,82C,87C,95C 'melapress':34B,79C 'n/a':97C 'neutral':66C 'packag':18B 'page':64B,71C 'plant':50B 'plugin':32B 'run':10A,53B 'script':11A,41B,51B,76C 'secur':85C 'self':20B 'self-host':19B 'site':40B,75C 'store':4A,37B,89C 'version':44B 'view':60B 'vulner':77C 'web':70C 'wordpress':22B,31B 'wp':1A,24B,27B,80C,84C,93C 'wp-activity-log':23B 'wp-security-audit-log':83C 'xss':5A 'xss.this':90C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Activity Log (wp-security-audit-log) WordPress plugin at version 5.6.7 or earlier are affected. The sources do not say which user roles can inject the stored script, or whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpactivitylog"],"campaign_type":null,"search_a":"'-121573':14A,17A '-2026':13A,16A '5.6.7':7A 'activ':2A 'attack':9A 'cve':12A,15A 'let':8A 'log':3A 'run':10A 'script':11A 'store':4A 'wp':1A 'xss':5A","search_b":"'5.6.7':46B 'activ':25B,28B 'affect':62B 'anyon':58B 'attack':48B 'browser':56B 'cross':39B 'cross-sit':38B 'flaw':42B 'host':21B 'log':26B,29B,63B 'melapress':34B 'packag':18B 'page':64B 'plant':50B 'plugin':32B 'run':53B 'script':41B,51B 'self':20B 'self-host':19B 'site':40B 'store':37B 'version':44B 'view':60B 'wordpress':22B,31B 'wp':24B,27B 'wp-activity-log':23B","search_c":"'5.6.7':99C 'activ':81C,94C 'affect':92C 'allow':88C 'audit':86C 'cross':74C 'cross-sit':73C 'generat':72C 'improp':65C 'input':68C 'issu':91C 'log':82C,87C,95C 'melapress':79C 'n/a':97C 'neutral':66C 'page':71C 'script':76C 'secur':85C 'site':75C 'store':89C 'vulner':77C 'web':70C 'wp':80C,84C,93C 'wp-security-audit-log':83C 'xss.this':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121573","severity":null,"published_at":"2026-11-09T19:16:45+00:00","modified_at":"2026-11-09T19:16:46+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}