4.6.1

DATE	CVE	VULNERABILITY TITLE	RISK
2025-02-17	CVE-2025-0924	Cross-site Scripting vulnerability in Melapress WP Activity LOG The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. network low complexity melapress CWE-79	6.1
2024-04-09	CVE-2024-2018	SQL Injection vulnerability in Melapress WP Activity LOG The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. network low complexity melapress CWE-89	8.8
2024-02-29	CVE-2023-50905	Unspecified vulnerability in Melapress WP Activity LOG 4.5.3/4.6.0/4.6.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1. network low complexity melapress	6.1