Melapress records

15 published records for vendor melapress.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 60%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2024-2018No exploit	WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injectionmelapress · wp activity log · CWE-89 SQL injection	High8.8	—	0.9%	Apr 9, 2024
32Monitor	CVE-2025-2876No exploit	MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletionmelapress · melapress login security · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.4%	Apr 8, 2025
30Monitor	CVE-2022-44587No exploit	WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerabilitymelapress · wp 2fa · CWE-532 Pre-auth Info leak	High7.5	—	0.4%	Jun 21, 2024
28Monitor	CVE-2025-39565No exploit	WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerabilitymelapress · melapress login security · CWE-502 Deserialization	High7.2	—	0.9%	Apr 16, 2025
28Monitor	CVE-2024-35650No exploit	WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerabilitymelapress · melapress login security · CWE-98	High7.2	—	0.6%	Jun 10, 2024
25Monitor	CVE-2025-0767No exploit	WP Activity Log 5.3.2 - Insecure deserializationmelapress · wp activity log · CWE-502 Pre-auth Deserialization	Medium6.3	—	0.5%	Feb 27, 2025
24Monitor	CVE-2025-0924Proof of concept	WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scriptingmelapress · wp activity log · CWE-79 Pre-auth XSS	Medium6.1	—	1.4%	Feb 17, 2025
24Monitor	CVE-2024-10793Proof of concept	WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parametermelapress · wp activity log · CWE-79 Pre-auth XSS	Medium6.1	—	1.4%	Nov 15, 2024
24Monitor	CVE-2024-32568No exploit	WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymelapress · wp 2fa · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Apr 18, 2024
24Monitor	CVE-2023-50905No exploit	WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)melapress · wp activity log · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Feb 29, 2024
21Monitor	CVE-2022-44595No exploit	WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerabilitymelapress · wp 2fa · CWE-287 Pre-auth Auth bypass	Medium5.3	—	0.5%	Mar 21, 2024
21Monitor	CVE-2024-9879No exploit	Website File Changes < 2.1.1 - Authenticated SQL Injectionmelapress · melapress file monitor · CWE-89 SQL injection	Medium5.4	—	0.3%	May 15, 2025
21Monitor	CVE-2025-3702No exploit	WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerabilitymelapress · melapress file monitor · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.3%	Jul 3, 2025
17Monitor	CVE-2023-6520No exploit	WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgerymelapress · wp 2fa · CWE-352 Pre-auth CSRF	Medium4.3	—	0.2%	Jan 11, 2024
16Monitor	CVE-2024-10009No exploit	Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injectionmelapress · melapress file monitor · CWE-89 SQL injection	Medium4.1	—	0.4%	May 15, 2025

CVE-2024-2018
35Monitor
WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injection
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
melapress · wp activity logApr 9, 2024
CVE-2025-2876
32Monitor
MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
melapress · melapress login securityApr 8, 2025
CVE-2022-44587
30Monitor
WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
melapress · wp 2faJun 21, 2024
CVE-2025-39565
28Monitor
WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerability
HighCVSS 7.2No exploitEPSS 1%
- Deserialization
melapress · melapress login securityApr 16, 2025
CVE-2024-35650
28Monitor
WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability
HighCVSS 7.2No exploitEPSS 1%
melapress · melapress login securityJun 10, 2024
CVE-2025-0767
25Monitor
WP Activity Log 5.3.2 - Insecure deserialization
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
- Deserialization
melapress · wp activity logFeb 27, 2025
CVE-2025-0924
24Monitor
WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
melapress · wp activity logFeb 17, 2025
CVE-2024-10793
24Monitor
WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
melapress · wp activity logNov 15, 2024
CVE-2024-32568
24Monitor
WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
melapress · wp 2faApr 18, 2024
CVE-2023-50905
24Monitor
WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
melapress · wp activity logFeb 29, 2024
CVE-2022-44595
21Monitor
WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
melapress · wp 2faMar 21, 2024
CVE-2024-9879
21Monitor
Website File Changes < 2.1.1 - Authenticated SQL Injection
MediumCVSS 5.4No exploitEPSS 0%
- SQL injection
melapress · melapress file monitorMay 15, 2025
CVE-2025-3702
21Monitor
WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
melapress · melapress file monitorJul 3, 2025
CVE-2023-6520
17Monitor
WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
melapress · wp 2faJan 11, 2024
CVE-2024-10009
16Monitor
Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection
MediumCVSS 4.1No exploitEPSS 0%
- SQL injection
melapress · melapress file monitorMay 15, 2025