7.6High

CVE-2026-62085WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

Melapress WP Activity Log Published: 2026-09-30 15:26 (1 month ago)

Description

Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

Weakness (CWE): CWE-89

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Melapress	WP Activity Log	≤ 5.6.6

References and patches

https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-lo… vdb-entry

CVSS score

7.6High

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

All scores (2)

cna	CVSS 3.1	7.6High
audit@patchstack.com	CVSS 3.1	7.6High

EPSS (chance of exploitation in 30 days)

0.31%

higher than 24% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-07-13
Published2026-09-30 15:26
Reached IP-DB2026-10-24 23:45
Last updated2026-09-30 17:17

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

8.8High

CVE-2026-124251 3 hours ago

WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerability

XplodedThemes WPIDE – File Manager & Code Editor

Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.

5.3Medium

CVE-2026-106007 10 hours ago

FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_send

FraudLabs Pro SMS Verification

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting th…

5.3Medium

CVE-2026-106025 10 hours ago

Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation

Cargo Shipping Location for WooCommerce

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users …

7.2High

CVE-2026-84938 12 hours ago

Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook

themefusion Avada (Fusion) Builder

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient …

7.5High

CVE-2026-100386 12 hours ago

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser

themefic Ultra Addons for Contact Form 7

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents …

7.2High

CVE-2026-93427 12 hours ago

ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Field

armember ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.…