Melapress vulnerabilities, page 2
31 vulnerabilities
Known vulnerabilities in Melapress products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.
CVE-2026-62142melapresswp_2fa+1
EPSS score0.13%
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.CVE-2026-62085melapresswp_activity_log+1EPSS score0.31%
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.CVE-2026-25331melapresswp_activity_log+1EPSS score0.19%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4.CVE-2026-56005melapresswp_activity_log+1EPSS score0.25%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.CVE-2026-45435melapresswp_activity_log+1EPSS score0.22%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.
This issue affects WP Activity Log: from n/a through 5.6.3.CVE-2026-96827melapressadmin notices manager+1EPSS score0.28%
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.CVE-2023-2261melapresswp_activity_log+4EPSS score0.55%
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of users with accounts on the site. This includes ids, usernames and emails.CVE-2023-2286melapresswp_activity_log+4EPSS score0.30%
The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2023-6506melapresswp 2fa – two-factor authentication for wordpress+2EPSS score0.47%
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site.CVE-2023-6520melapresswp_2fa+2EPSS score0.25%
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.CVE-2023-50905melapresswp_activity_log+1EPSS score0.33%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1.