Cpe:2.3:a:wp_activity_log:wp_activity_log:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awp_activity_logwp_activity_log/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 09:56:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWP Activity Log: Stored Cross-Site Scripting (CVE-2026-120075)https://feed.craftedsignal.io/briefs/2026-10-wp-activity-log-xss/Sat, 31 Oct 2026 09:56:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wp-activity-log-xss/The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.6.1 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts.<p>The WP Activity Log plugin for WordPress, in all versions up to and including 5.6.1, is vulnerable to Stored Cross-Site Scripting. This vulnerability is caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> highadvisory