WordPress WP Activity Log <= 5.6.3.1 XSS Vulnerability Advisory

WordPress WP Activity Log Plugin <= 5.6.3.1 Contains an XSS Vulnerability Vulnerability Overview Vulnerability Type: Cross-Site Scripting (XSS) Priority: Medium Priority Description: This vulnerability allows malicious attackers to inject malicious scripts, such as redirects, advertisements, and other HTML payloads, into your website. These scripts will be executed when visitors access your site. Impact Scope Affected Versions: <= 5.6.3.1 Fixed Version: 5.6.4 Remediation Immediate Action: Update the affected plugin. If you are unable to do so, contact your hosting provider or website developer for assistance. Automatic Mitigation: Patchstack has released mitigation rules to block any attacks until you update to the patched version. Manual Update: Update to version 5.6.4 or higher to resolve the vulnerability. Patchstack users can enable automatic updates for vulnerable plugins. Risk User Interaction Requirement: Although this vulnerability can be initiated by users with the roles shown in “Required Permissions,” successful exploitation requires a privileged user to perform an action—such as clicking a malicious link, visiting a spoofed page, or submitting a form. XSS Attacks: This can lead to the injection of malicious scripts, impacting website security and user experience. Details Software: WP Activity Log Type: Plugin Vulnerable Version: <= 5.6.3.1 Fixed Version: 5.6.4 Timeline Report Date: May 25, 2026 Reporter: daroo FAQs How does Patchstack provide the fastest protection? How does Patchstack mitigate vulnerabilities? Why are hackers targeting my website? What if my website has already been compromised? Subscription Weekly WordPress Security Intelligence: Enter your email address to subscribe.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress WP Activity Log <= 5.6.3.1 XSS Vulnerability Advisory