WP Activity Log

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

603 searches this plugin appeared in over the last 90 days, 20 listed. 555 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 69% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 10 months ago; a band this size takes about a year or more to cross, which places it about 80% of the way through.

1. ★★★★★ andrewwilliams1275

   4mo ago

   We used the Pro version of WP Activity Log. We needed a plugin for log shipping to AWS CloudWatch, and the plugin set up was intuitive, and simple to configure and connect to CloudWatch. The documentation is comprehensive and was easy to follow, and customer support reponses were quick and knowledgeable. Highly recommend WP Activity Log.

   Read on wp.org ↗
2. ★★★★★ nickwells04

   5mo ago

   We’ve been using WP Activity Log and have been extremely happy with both the product and the team behind it. The plugin does exactly what it promises and gives us valuable insight into what’s happening on our WordPress sites. What really stood out, though, was the customer support. We ran into a very small issue and reached out to their team for help. They responded quickly, provided clear guidance and gave us exactly what we needed to resolve the problem. It’s always reassuring to know there’s a knowledgeable and responsive support team backing up a great product. Highly recommend WP Activity Log and Melapress to anyone looking for a reliable activity logging solution for WordPress.

   Read on wp.org ↗
3. ★★★★★ headsdont

   7mo ago

   Great support. Fast and responsive. Highly recommended.

   Read on wp.org ↗
4. ★★★★★ ikoberg

   8mo ago

   Our team has used the plugin across several projects for a number of years. A useful utility with fantastic support. Recommended.

   Read on wp.org ↗
5. ★★★★★ giugent

   8mo ago

   Quick answer and very accurate.

   Read on wp.org ↗
6. ★★★★★ bru09

   8mo ago

   Quick answer and very accurate.Thanks for this useful plugin …

   Read on wp.org ↗
7. ★★★★★ luthermax

   9mo ago

   This plugin has been very useful for us and when we needed help with using it for specific tasks, the developers were very responsive and attentive to our needs. Would recommend!

   Read on wp.org ↗
8. ★★★★★ DarkNova

   9mo ago

   I love the pro version!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-19 Version 5.6.8 Functionality & plugin improvements Improved the license activation flow after upgrading. Opening WP Activity Log now shows the license prompt when activation is required. Refined the plugin’s licensing structure to supp 5.6.8
2. 2026-09-22 Version 5.6.7 Security fix Fixed an Administrator SQL Injection responsibly reported by Ananda Dhakal. Functionality & plugin improvements Updated the External DB mirroring screen to use the plugin’s existing Select2 4.0.13 library in 5.6.7
3. 2026-08-24 Version 5.6.6 Functionality & plugin improvements Improved username search queries by using WordPress prepared statements. Replaced json_encode() with wp_json_encode() in Search extension AJAX responses for better character encoding s 5.6.6
4. 2026-07-21 Version 5.6.5 New activity log event IDs Event ID 6073 – Requested to change the Administrator email address. The event records the current and requested addresses across single sites, multisite networks, and individual subsites. New 5.6.5

All 21 disclosed vulnerabilities are patched in the current version (5.6.8). Sites still on an older version should update.

1. Patched High · 7.2 WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-10-30 CVE-2026-120075 Improper Neutralization of Input During Web Page Generation Affects <= 5.6.1 Patched in 5.6.2
2. Patched Medium · 4.9 WP Activity Log <= 5.6.6 - Authenticated (Administrator+) SQL Injection ↗
   2026-09-30 CVE-2026-62085 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.6.6 Patched in 5.6.7
3. Patched Medium · 4.3 WP Activity Log <= 5.6.4 - Cross-Site Request Forgery ↗
   2026-07-23 CVE-2026-65512 Cross-Site Request Forgery Affects <= 5.6.4 Patched in 5.6.5
4. Patched Medium · 6.4 WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-06-19 CVE-2026-56005 Improper Neutralization of Input During Web Page Generation Affects <= 5.6.3.1 Patched in 5.6.4
5. Patched High · 8.1 WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection ↗
   2026-06-16 CVE-2026-54806 Deserialization of Untrusted Data Affects <= 5.6.3.1 Patched in 5.6.4
6. Patched Medium · 6.4 WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-05-19 CVE-2026-45435 Improper Neutralization of Input During Web Page Generation Affects <= 5.6.3 Patched in 5.6.3.1
7. Patched Medium · 6.4 Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-02-14 CVE-2026-25331 Improper Neutralization of Input During Web Page Generation Affects <= 5.5.4 Patched in 5.6.0
8. Patched Medium · 6.6 WP Activity Log <= 5.3.2 - Authenticated (Admin+) PHP Object Injection ↗
   2025-02-27 CVE-2025-0767 Deserialization of Untrusted Data Affects <= 5.3.2 Patched in 5.3.3
9. Patched High · 7.2 WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2025-02-12 CVE-2025-0924 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.2 Patched in 5.3.0
10. Patched High · 7.2 WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter ↗
    2024-11-14 CVE-2024-10793 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.1 Patched in 5.2.2
11. Patched Medium · 6.1 WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-02-14 CVE-2023-50905 Improper Neutralization of Input During Web Page Generation Affects <= 4.6.1 Patched in 4.6.2
12. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects 3.0.0 - 4.4.2.1 Patched in 4.4.3
13. Patched Medium · 4.3 WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup ↗
    2023-05-17 CVE-2023-2286 Cross-Site Request Forgery Affects <= 4.5.0 Patched in 4.5.2
14. Patched Medium · 4.3 WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration ↗
    2023-05-17 CVE-2023-2261 Missing Authorization Affects <= 4.5.0 Patched in 4.5.2
15. Patched Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 4.4.0 Patched in 4.4.0
16. Patched Critical · 9.8 WP Activity Log <= 4.1.4 - SQL Injection ↗
    2020-11-04 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.1.5 Patched in 4.1.5
17. Patched High · 7.3 WP Activity Log <= 4.0.1 - Missing Authorization ↗
    2020-03-08 CVE-2020-36716 Missing Authorization Affects < 4.0.2 Patched in 4.0.2
18. Patched High · 8.8 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update ↗
    2019-02-25 Missing Authorization Affects < 3.3.1.2 Patched in 3.3.1.2
19. Patched Medium · 5.3 WP Security Audit Log <= 3.1.1 - Sensitive Information Disclosure ↗
    2018-03-28 CVE-2018-8719 Insertion of Sensitive Information into Log File Affects <= 3.1.1 Patched in 3.1.2
20. Patched High · 7.1 WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting ↗
    2016-06-27 Improper Neutralization of Input During Web Page Generation Affects 1.5 - 2.4.3 Patched in 2.4.4
21. Patched High · 8.8 WP Activity Log <= 1.2.4 - Cross-Site Request Forgery ↗
    2014-08-01 CVE-2014-5072 Cross-Site Request Forgery Affects < 1.2.5 Patched in 1.2.5

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 29 languages, 6 at 90% or more

Plus 5 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-01-11 200K+ → 300K+ up after 8 days in tier
2. 2026-01-03 300K+ → 200K+ down after 4 days in tier
3. 2025-12-30 200K+ → 300K+ up after 1 days in tier
4. 2025-12-29 300K+ → 200K+ down after 5 days in tier
5. 2025-12-24 200K+ → 300K+ up after 1049 days in tier
6. 2023-02-09 100K+ → 200K+ up after 1222 days in tier
7. 2019-10-06 90K+ → 100K+ up after 125 days in tier
8. 2019-06-03 80K+ → 90K+ up after 153 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WP Activity Log into a readme, a review or a deck. It updates itself.

WP Activity Log: 300K+ active installs, 4.7★ (490 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/wp-security-audit-log