CVE-2026-45435: WP Activity Log XSS Vulnerability

CVE-2026-45435 Overview

CVE-2026-45435 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Melapress WP Activity Log plugin for WordPress. The flaw affects all plugin versions through 5.6.3 and stems from improper neutralization of input during web page generation [CWE-79]. Attackers with low-privileged authenticated access can inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page element. Successful exploitation allows session hijacking, administrative action forgery, and content manipulation within the WordPress admin interface. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on 2026-05-25.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the browser context of WP Activity Log users, enabling administrative session compromise on affected WordPress sites.

Affected Products

Melapress WP Activity Log plugin for WordPress
All versions from n/a through 5.6.3
WordPress sites running the wp-security-audit-log plugin

Discovery Timeline

2026-05-25 - CVE-2026-45435 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-45435

Vulnerability Analysis

The vulnerability is a DOM-based Cross-Site Scripting flaw within the WP Activity Log plugin. DOM-based XSS occurs when client-side JavaScript reads attacker-controllable data from sources such as location.hash, location.search, or document.referrer, then writes it to a sink such as innerHTML or document.write without proper sanitization. In this case, the plugin's client-side logic processes input that influences page generation without sufficient neutralization.

Exploitation requires user interaction and low privileges on the target WordPress instance. The scope change indicator on this issue reflects that script execution affects resources beyond the vulnerable component, including the broader WordPress administrative interface. Confidentiality, integrity, and availability are each impacted to a limited degree.

Root Cause

The root cause is improper neutralization of user-controlled input during web page generation, classified as [CWE-79]. The plugin's JavaScript writes attacker-influenced strings into the Document Object Model (DOM) without applying context-appropriate encoding or sanitization routines. Because the unsafe write occurs entirely client-side, server-side filtering does not block the payload.

Attack Vector

The attack vector is network-based and requires user interaction. An authenticated attacker with low privileges crafts a URL or input containing a JavaScript payload, then delivers it to a higher-privileged user such as an administrator. When the victim opens the link inside a WordPress session with WP Activity Log loaded, the client-side script writes the payload into the DOM, triggering execution under the victim's origin. See the Patchstack WordPress Vulnerability advisory for technical details.

Detection Methods for CVE-2026-45435

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs rendered inside WP Activity Log admin pages
WordPress access logs containing requests to plugin pages with suspicious URL fragments or query parameters carrying encoded HTML or JavaScript
New or modified WordPress administrator accounts created shortly after an admin clicked an external link
Outbound HTTP requests from admin browsers to unfamiliar domains immediately after loading the activity log interface

Detection Strategies

Inspect HTTP request and referrer data for payloads containing <, >, onerror=, onload=, or encoded equivalents targeting plugin endpoints
Monitor WordPress audit trails for privilege changes, plugin installations, or option updates that follow administrative sessions
Deploy a Web Application Firewall (WAF) rule set that flags XSS patterns on URLs referencing wp-security-audit-log paths

Monitoring Recommendations

Enable browser-side Content Security Policy (CSP) reporting to capture blocked inline script executions on wp-admin pages
Forward WordPress and web server logs to a centralized analytics platform and alert on anomalous query strings against plugin URLs
Review user session telemetry for concurrent logins, unusual IP addresses, or rapid configuration changes by administrators

How to Mitigate CVE-2026-45435

Immediate Actions Required

Update the WP Activity Log plugin to a version later than 5.6.3 as soon as a patched release is published by Melapress
Audit all administrator and editor accounts for unauthorized changes made since the plugin was installed
Restrict plugin access to trusted administrators and revoke unnecessary contributor or author privileges
Force a password reset and invalidate active sessions for all privileged WordPress users

Patch Information

The vulnerability affects WP Activity Log versions through 5.6.3. Site operators should consult the Patchstack advisory and the Melapress plugin changelog for the fixed version once released, then apply the update through the WordPress plugin dashboard or wp-cli.

Workarounds

Deactivate the WP Activity Log plugin until a patched release is installed if administrative use is non-essential
Deploy a WAF rule that blocks requests containing common XSS payloads targeting /wp-admin/admin.php?page=wsal-* endpoints
Apply a strict Content Security Policy that disallows inline scripts on the WordPress admin interface to reduce DOM XSS impact
Train administrators to avoid clicking untrusted links while logged into WordPress

bash

# Update WP Activity Log via wp-cli once a patched release is available
wp plugin update wp-security-audit-log

# Verify the installed version is above 5.6.3
wp plugin get wp-security-audit-log --field=version