WP Activity Log

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 69% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ andrewwilliams1275

   1mo ago

   We used the Pro version of WP Activity Log. We needed a plugin for log shipping to AWS CloudWatch, and the plugin set up was intuitive, and simple to configure and connect to CloudWatch. The documentation is comprehensive and was easy to follow, and customer support reponses were quick and knowledgeable. Highly recommend WP Activity Log.

   Read on wp.org ↗
2. ★★★★★ nickwells04

   3mo ago

   We’ve been using WP Activity Log and have been extremely happy with both the product and the team behind it. The plugin does exactly what it promises and gives us valuable insight into what’s happening on our WordPress sites. What really stood out, though, was the customer support. We ran into a very small issue and reached out to their team for help. They responded quickly, provided clear guidance and gave us exactly what we needed to resolve the problem. It’s always reassuring to know there’s a knowledgeable and responsive support team backing up a great product. Highly recommend WP Activity Log and Melapress to anyone looking for a reliable activity logging solution for WordPress.

   Read on wp.org ↗
3. ★★★★★ headsdont

   5mo ago

   Great support. Fast and responsive. Highly recommended.

   Read on wp.org ↗
4. ★★★★★ ikoberg

   5mo ago

   Our team has used the plugin across several projects for a number of years. A useful utility with fantastic support. Recommended.

   Read on wp.org ↗
5. ★★★★★ giugent

   6mo ago

   Quick answer and very accurate.

   Read on wp.org ↗
6. ★★★★★ bru09

   6mo ago

   Quick answer and very accurate.Thanks for this useful plugin …

   Read on wp.org ↗
7. ★★★★★ luthermax

   6mo ago

   This plugin has been very useful for us and when we needed help with using it for specific tasks, the developers were very responsive and attentive to our needs. Would recommend!

   Read on wp.org ↗
8. ★★★★★ DarkNova

   6mo ago

   I love the pro version!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-07-21 Version 5.6.5 New activity log event IDs Event ID 6073 – Requested to change the Administrator email address. The event records the current and requested addresses across single sites, multisite networks, and individual subsites. New 5.6.5

19 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 WP Activity Log <= 5.6.4 - Cross-Site Request Forgery ↗
   2026-07-23 CVE-2026-65512 Cross-Site Request Forgery (CSRF) Affects <= 5.6.4 Patched in 5.6.5
2. Medium · 6.4 WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-06-19 CVE-2026-56005 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.6.3.1 Patched in 5.6.4
3. High · 8.1 WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection ↗
   2026-06-16 CVE-2026-54806 Deserialization of Untrusted Data Affects <= 5.6.3.1 Patched in 5.6.4
4. Medium · 6.4 WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-05-19 CVE-2026-45435 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.6.3 Patched in 5.6.3.1
5. Medium · 6.4 Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-02-14 CVE-2026-25331 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.5.4 Patched in 5.6.0
6. Medium · 6.6 WP Activity Log <= 5.3.2 - Authenticated (Admin+) PHP Object Injection ↗
   2025-02-27 CVE-2025-0767 Deserialization of Untrusted Data Affects <= 5.3.2 Patched in 5.3.3
7. High · 7.2 WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2025-02-12 CVE-2025-0924 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.2 Patched in 5.3.0
8. High · 7.2 WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter ↗
   2024-11-14 CVE-2024-10793 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.1 Patched in 5.2.2
9. Medium · 6.1 WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting ↗
   2024-02-14 CVE-2023-50905 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.6.1 Patched in 4.6.2
10. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 3.0.0 - 4.4.2.1 Patched in 4.4.3
11. Medium · 4.3 WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup ↗
    2023-05-17 CVE-2023-2286 Cross-Site Request Forgery (CSRF) Affects <= 4.5.0 Patched in 4.5.2
12. Medium · 4.3 WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration ↗
    2023-05-17 CVE-2023-2261 Missing Authorization Affects <= 4.5.0 Patched in 4.5.2
13. Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 4.4.0 Patched in 4.4.0
14. Critical · 9.8 WP Activity Log <= 4.1.4 - SQL Injection ↗
    2020-11-04 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.1.5 Patched in 4.1.5
15. High · 7.3 WP Activity Log <= 4.0.1 - Missing Authorization ↗
    2020-03-08 CVE-2020-36716 Missing Authorization Affects < 4.0.2 Patched in 4.0.2
16. High · 8.8 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update ↗
    2019-02-25 Missing Authorization Affects < 3.3.1.2 Patched in 3.3.1.2
17. Medium · 5.3 WP Security Audit Log <= 3.1.1 - Sensitive Information Disclosure ↗
    2018-03-28 CVE-2018-8719 Insertion of Sensitive Information into Log File Affects <= 3.1.1 Patched in 3.1.2
18. High · 7.1 WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting ↗
    2016-06-27 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 1.5 - 2.4.3 Patched in 2.4.4
19. High · 8.8 WP Activity Log <= 1.2.4 - Cross-Site Request Forgery ↗
    2014-08-01 CVE-2014-5072 Cross-Site Request Forgery (CSRF) Affects < 1.2.5 Patched in 1.2.5

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 27 languages, 4 at 90% or more

Plus 3 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-01-11 200K+ → 300K+ up after 8 days in tier
2. 2026-01-03 300K+ → 200K+ down after 4 days in tier
3. 2025-12-30 200K+ → 300K+ up after 1 days in tier
4. 2025-12-29 300K+ → 200K+ down after 5 days in tier
5. 2025-12-24 200K+ → 300K+ up after 1049 days in tier
6. 2023-02-09 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Unbranded Portal Connector 80+ installs · 3.6★ · 5 shared tags C
• ActivityLog – wordpress logging for actions inside admin 30+ installs · 3.6★ · 4 shared tags C
• Simple History – Track, Log, and Audit WordPress Changes 300K+ installs · 4.9★ · 3 shared tags A
• Stream – Activity Log & Audit Trail 80K+ installs · 4.2★ · 3 shared tags A
• Logify WP – Activity Log & User Audit Log 200+ installs · 4.1★ · 3 shared tags B
• Adminify Activity Log & Audit Trail 200+ installs · 3.6★ · 3 shared tags B

Embed this report card

Drop a live Pulse card for WP Activity Log into a readme, a review or a deck. It updates itself.

WP Activity Log: 300K+ active installs, 4.7★ (486 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wp-security-audit-log