Melapress
- Total products in the ecosystem
- 9
- Total vulnerabilities (90 days)
- 4
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Melapress recorded 4 security vulnerabilities in the last 90 days across 3 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, WP Activity Log had the most security vulnerabilities in the Melapress ecosystem, with 2 vulnerabilities—approximately 50% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109900WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerabilityCVE-2026-109899WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerabilityCVE-2026-120075WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-62142WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-96827WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-109900WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes |
| Published11/08/2026 |
| SeverityCritical |
CVE-2026-109899WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productMelapress Role Editor | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-120075WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published10/31/2026 | SeverityHigh |
|---|
CVE-2026-62142WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP 2FA | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-96827WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productAdmin Notices Manager | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-62085WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-65512WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published07/23/2026 | SeverityMedium |
|---|
CVE-2026-56005WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-54806WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published06/17/2026 | SeverityCritical |
|---|
CVE-2026-45435WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published05/25/2026 | SeverityMedium |
|---|
CVE-2026-25331WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published02/19/2026 | SeverityMedium |
|---|
CVE-2025-14866Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment | Exploitation statusNot exploited | FixYes | Affected productMelapress Role Editor | Published01/23/2026 | SeverityHigh |
|---|
CVE-2025-6895MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function | Exploitation statusNot exploited | FixYes | Affected productMelaPress Login Security | Published07/26/2025 | SeverityCritical |
|---|
CVE-2025-3702WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productMelapress File Monitor | Published07/03/2025 | SeverityMedium |
|---|
CVE-2025-39565WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerability | Exploitation statusNot exploited | FixYes | Affected productMelaPress Login Security | Published04/16/2025 | SeverityMedium |
|---|
CVE-2025-2876MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion | Exploitation statusNot exploited | FixNo | Affected productMelaPress Login Security | Published04/08/2025 | SeverityMedium |
|---|
CVE-2025-0767WP Activity Log 5.3.2 - Insecure deserialization | Exploitation statusNot exploited | FixNo | Affected productWP Activity Log | Published02/27/2025 | SeverityMedium |
|---|
CVE-2025-0924WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published02/17/2025 | SeverityHigh |
|---|
CVE-2024-10793WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published11/15/2024 | SeverityHigh |
|---|
CVE-2024-35650WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productMelaPress Login Security | Published06/10/2024 | SeverityMedium |
|---|
CVE-2024-1717Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval | Exploitation statusNot exploited | FixYes | Affected productAdmin Notices Manager | Published06/04/2024 | SeverityMedium |
|---|
CVE-2024-32568WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP 2FA | Published04/18/2024 | SeverityHigh |
|---|
CVE-2022-44595WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP 2FA | Published03/21/2024 | SeverityMedium |
|---|
CVE-2023-50905WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS) | Exploitation statusActively exploited | FixYes | Affected productWP Activity Log | Published02/29/2024 | SeverityHigh |
|---|
CVE-2023-6520WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery | Exploitation statusNot exploited | FixYes | Affected productWP 2FA – Two-factor authentication for WordPress | Published01/11/2024 | SeverityMedium |
|---|
CVE-2023-6506WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending | Exploitation statusNot exploited | FixYes | Affected productWP 2FA – Two-factor authentication for WordPress | Published01/11/2024 | SeverityMedium |
|---|
CVE-2023-2286WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published06/09/2023 | SeverityMedium |
|---|
CVE-2023-2261WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published06/09/2023 | SeverityMedium |
|---|
CVE-2020-36716WP Activity Log <= 4.0.1 - Missing Authorization | Exploitation statusNot exploited | FixYes | Affected productWP Activity Log | Published06/07/2023 | SeverityHigh |
|---|
27 Results | Page 1 of 1