CVE-2026-120075 in WP Activity Log Plugin
Summary
by MITRE • 10/31/2026
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The WP Activity Log plugin, widely utilized by WordPress administrators to monitor site activity and track changes made by users, contains a critical security flaw affecting all versions up through 5.6.1. This vulnerability manifests as a Stored Cross-Site Scripting issue rooted in insufficient input sanitization and inadequate output escaping mechanisms within the application code. Unlike reflected XSS attacks where malicious scripts are executed immediately upon request, stored vulnerabilities persist on the target server by being saved into databases or other storage mediums. In this specific case, the flaw allows unauthenticated attackers to inject arbitrary web script payloads directly into pages managed by the plugin. Because these injected scripts are stored within the application's data layer, they remain active and will execute automatically whenever any user accesses a page containing the malicious content.
The technical nature of this vulnerability stems from the failure to properly validate or encode user-supplied input before it is processed and rendered in the browser environment. When an unauthenticated actor submits crafted data through exposed endpoints or forms within the WP Activity Log interface, the application fails to strip out dangerous HTML tags or JavaScript code blocks. Consequently, these scripts become part of the persistent state of the website. This lack of robust sanitization violates fundamental web security principles regarding trust boundaries and input handling. The absence of proper output escaping means that when the compromised data is retrieved from storage and displayed in a user's browser, it is interpreted as executable code rather than plain text by the client-side environment.
The operational impact of this vulnerability is severe due to its persistent nature and the potential for widespread exposure. Since the attack does not require authentication, any external actor on the internet can exploit it without needing valid credentials or prior access privileges. Once a script is stored, every administrator or user who views the affected activity log entries will have their browser execute the malicious code in the context of the vulnerable WordPress site. This scenario facilitates session hijacking, where attackers can steal administrative cookies and take over active sessions to gain full control of the website. It also enables credential harvesting through fake login forms injected into the page content, as well as defacement or redirection attacks that damage the reputation and integrity of the organization hosting the site.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents Stored XSS where malicious content is saved on the server side rather than being passed via URL parameters or headers. In terms of offensive security frameworks such as MITRE ATT&CK for Enterprise, this exploit maps to techniques involving Client-side Injection and potentially Credential Access if session tokens are harvested. The persistence aspect also relates to Persistence mechanisms in certain contexts where stored scripts might be used to maintain long-term access or exfiltrate data over time without further interaction from the attacker.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running versions of WP Activity Log up to 5.6.1 should upgrade to a patched version that addresses these input validation and output encoding deficiencies as soon as possible. In environments where patching is delayed, temporary mitigations include implementing Web Application Firewall rules designed to detect and block common XSS payloads in HTTP requests targeting the plugin's endpoints. Additionally, enabling Content Security Policy headers can help restrict the execution of inline scripts, thereby reducing the impact even if an injection attempt succeeds. Regular security audits and code reviews focusing on data flow from user input to browser output are essential for preventing similar vulnerabilities in future development cycles.