Plugin icon

WP Activity Log

wp-security-audit-log

Vulnerabilities:

13

Last Updated:

March 5, 2026

Active Installs:

300000

Published
Title
Fixed in
CVSS
Published
2026-02-14
Title
Activity Log < 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.6.0
CVSS
6.4 (medium)
Published
2025-02-27
Title
WP Activity Log < 5.3.3 - Authenticated (Admin+) PHP Object Injection
Fixed in
Fixed in 5.3.3
CVSS
6.6 (medium)
Published
2025-02-12
Title
WP Activity Log < 5.3.0 - Unauthenticated Stored XSS
Fixed in
Fixed in 5.3.0
CVSS
7.2 (high)
Published
2024-11-14
Title
WP Activity Log < 5.2.2 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
Fixed in
Fixed in 5.2.2
CVSS
7.1 (high)
Published
2024-02-14
Title
WP Activity Log < 4.6.2 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 4.6.2
CVSS
6.1 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.4.3
CVSS
6.1 (medium)
Published
2023-05-17
Title
WP Activity Log < 4.5.2 - Subscriber+ Information Leak
Fixed in
Fixed in 4.5.2
CVSS
4.3 (medium)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 4.4.0
CVSS
4.3 (medium)
Published
2020-11-02
Title
WP Activity Log < 4.1.5 - SQL Injection in External Database Module
Fixed in
Fixed in 4.1.5
CVSS
8.8 (high)
Published
2020-03-08
Title
WP Security Audit Log < 4.0.2 - Broken Access Control in First-Time Install Wizard
Fixed in
Fixed in 4.0.2
CVSS
n/a
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Fixed in
Fixed in 3.3.1.2
CVSS
9.9 (critical)
Published
2018-03-28
Title
WP Security Audit Log Plugin <= 3.1.1 - Sensitive Information Disclosure
Fixed in
Fixed in 3.1.2
CVSS
5.3 (medium)
Published
2016-06-27
Title
WP Security Audit Log 1.5-2.4.3 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.4.4
CVSS
n/a