Melapress vulnerabilities
We track 12 vulnerabilities in Melapress products across 5 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on November 8, 2026.
Latest Melapress vulnerabilities
- 9.6 Critical severity
Melapress Role Editor: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0.
- 7.1 High severity
Melapress Role Editor: Missing Authorization
Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.
- 7.2 High severity
WP Activity Log: Improper Neutralization of Input During Web Page Generation
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra
- 8.8 High severity
WP 2FA: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
- 7.1 High severity
WP Activity Log: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
- 8.8 High severity
Melapress Role Editor: Incorrect Authorization
The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible for authentic
- 9.8 Critical severity
Melapress Login Security: Authentication Bypass Using an Alternate Path or Channel
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know
- 7.2 High severity
MelaPress Login Security: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaPress Login Security: from n/a through <= 2.1.0.
- 8.2 High severity
MelaPress Login Security Premium: Missing Authorization
The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenti
- 9.8 Critical severity
WP Activity Log: Deserialization of Untrusted Data
WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.
- 7.5 High severity
WP 2FA: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.
- 7.2 High severity
MelaPress Login Security: Inclusion of Functionality from Untrusted Control Sphere
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security melapress-login-security.This issue affects MelaPress Login Security: from n/a through <= 1.3.0.