Skip to content
PluginCanary

WP Activity Log

by Melapress · 300,000+ active installs · Checked 3 Nov 2026
Healthy2 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 5.6.2.

80/ 100 Canary Score
Sub-scores for WP Activity Log
Ownership100
Maintenance100
Security60
Support50
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 5.6.2. Update to version 5.6.2 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Sep 2026, fixed in 5.6.7. Update to version 5.6.7 or later.30 Sep 2026Evidence
  • InfoSEC-310 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
WPWhiteSecurity13 Aug 2013 to 9 Dec 2023, 486 commits
melapress9 Aug 2023 to 23 Sep 2026, 79 commits
lucianwpwhite20 Oct 2026 to 20 Oct 2026, 2 commits

New committer lucianwpwhite made a first commit on 20 Oct 2026.

Maintenance

Last release
15 days ago
Releases, 24 months
25
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for WP Activity Log
Q1 20243
Q2 20241
Q3 20243
Q4 20241
Q1 20254
Q2 20254
Q3 20253
Q4 20253
Q1 20262
Q2 20264
Q3 20263
Q4 20261

Last release 20 Oct 2026. Tested with WordPress 7.1 (current).

Support

50% of 6 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.6.15.6.20
30 Sep 2026WP Activity Log <= 5.6.6 - Authenticated (Administrator+) SQL Injection4.9<= 5.6.65.6.70
23 Jul 2026WP Activity Log <= 5.6.4 - Cross-Site Request Forgery4.3<= 5.6.45.6.50
19 Jun 2026WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 5.6.3.15.6.40
16 Jun 2026WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection8.1<= 5.6.3.15.6.40
19 May 2026WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 5.6.35.6.3.10
14 Feb 2026Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 5.5.45.6.00
27 Feb 2025WP Activity Log <= 5.3.2 - Authenticated (Admin+) PHP Object Injection6.6<= 5.3.25.3.36
12 Feb 2025WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.2.25.3.00
14 Nov 2024WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter7.2<= 5.2.15.2.20
14 Feb 2024WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting6.1<= 4.6.14.6.20
18 Jul 2023Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get6.13.0.0 to 4.4.2.14.4.30
17 May 2023WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration4.3<= 4.5.04.5.20
17 May 2023WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup4.3<= 4.5.04.5.20
4 Mar 2022Freemius SDK <= 2.4.2 - Missing Authorization Checks6.3< 4.4.04.4.00
4 Nov 2020WP Activity Log <= 4.1.4 - SQL Injection9.8< 4.1.54.1.51
8 Mar 2020WP Activity Log <= 4.0.1 - Missing Authorization7.3< 4.0.24.0.20
25 Feb 2019Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update8.8< 3.3.1.23.3.1.2718
28 Mar 2018WP Security Audit Log <= 3.1.1 - Sensitive Information Disclosure5.3<= 3.1.13.1.21052
27 Jun 2016WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting7.11.5 to 2.4.32.4.4987
1 Aug 2014WP Activity Log <= 1.2.4 - Cross-Site Request Forgery8.8< 1.2.51.2.51683

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for WP Activity Log
Q3 20255.0
Q4 20254.6
Q1 20265.0
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating stayed at 5.0 between Q3 2025 and Q4 2026.

Rating distribution
5 star434
4 star11
3 star8
2 star9
1 star28

Momentum

300,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Activity Log
4 May 202612,127
11 May 2026119,866
18 May 202645,117
25 May 202624,871
1 Jun 2026112,922
8 Jun 202634,098
15 Jun 202626,673
22 Jun 202621,134
29 Jun 202616,834
6 Jul 202622,281
13 Jul 202613,191
20 Jul 2026125,170
27 Jul 202638,414
3 Aug 202635,359
10 Aug 202618,519
17 Aug 202616,354
24 Aug 2026124,600
31 Aug 202638,619
7 Sep 202623,726
14 Sep 202628,263
21 Sep 2026135,571
28 Sep 202644,228
5 Oct 202629,613
12 Oct 202619,370
19 Oct 2026138,901
26 Oct 202656,192
2 Nov 20266,951

Weekly downloads over the last 4 weeks are 12% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

WP Last LoginScore 93 · 10,000+Activity Log - Monitor User and Agent ChangesScore 92 · 200,000+When Last LoginScore 91 · 40,000+User Activity Tracking and LogScore 91 · 2,000+Simple Login NotificationScore 91 · 2,000+

Facts

Version5.6.8
AuthorMelapress
Added23 May 2013
Last updated20 Oct 2026
Active installs300,000+
Requires WordPress5.5
Tested up to7.1.4
Requires PHP7.4
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tagslogger, history, event log, Activity Log, user tracking

Other plugins by this author: WP 2FA - Two-factor authentication for WordPress, Admin Notices Manager, Melapress File Monitor, Melapress Login Security, Melapress Role Editor

Questions

Is WP Activity Log still maintained?

WP Activity Log was last updated on 20 Oct 2026. Its Canary status is Healthy.

Is WP Activity Log safe?

WP Activity Log has no open unpatched vulnerabilities on record. 10 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WP Activity Log?

The wordpress.org author is Melapress. Recent committers: lucianwpwhite, melapress, WPWhiteSecurity, WPProHelp, plugin-master. New committer lucianwpwhite made a first commit on 20 Oct 2026.

What can I use instead of WP Activity Log?

Plugins in the same category with a higher Canary Score: WP Last Login, Activity Log - Monitor User and Agent Changes, When Last Login, User Activity Tracking and Log, Simple Login Notification.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue