WP Activity Log

90 Quality Score

Active Installs

25/30

With 300,000 active installs, WP Activity Log is among the most widely deployed activity log plugins in the WordPress ecosystem, justifying its strong popularity score.

Update Freshness

25/25

The plugin was updated very recently in June 2026 and has been actively maintained over a long period, earning a perfect maintenance score.

User Rating

14/15

A 94 out of 100 rating from 480 reviewers indicates broadly positive user sentiment, with most users finding the plugin reliable and feature-rich.

Support Health

11/15

Only 75% of the 8 visible support threads are resolved, which is a modest support health figure and suggests some users may experience slower or less complete responses.

WP Compatibility

15/15

It is tested with WordPress 7.0, requires WordPress 5.5 and PHP 7.4, indicating strong forward and backward compatibility across modern environments.

Scores higher than 99% of indexed plugins

About

The #1 user-rated activity log plugin for event logging, activity monitoring and change tracking.

Active Installs 300k+

Rating ★★★★½ 4.7/5

Last Updated 2026-09-23 7:32am GMT

Requires WordPress 5.5+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

19 known vulnerabilities, all patched

1 Critical 7 High 11 Medium

Most recent: July 23, 2026

View details ▸

WP Activity Log <= 5.6.4 - Cross-Site Request Forgery Medium

July 23, 2026 Patched in ["5.6.5"] CVE-2026-65512

WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

June 19, 2026 Patched in ["5.6.4"] CVE-2026-56005

WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection High

June 16, 2026 Patched in ["5.6.4"] CVE-2026-54806

WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

May 19, 2026 Patched in ["5.6.3.1"] CVE-2026-45435

Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

February 14, 2026 Patched in ["5.6.0"] CVE-2026-25331

WP Activity Log <= 5.3.2 - Authenticated (Admin+) PHP Object Injection Medium

February 27, 2025 Patched in ["5.3.3"] CVE-2025-0767

WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting High

February 12, 2025 Patched in ["5.3.0"] CVE-2025-0924

WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter High

November 14, 2024 Patched in ["5.2.2"] CVE-2024-10793

WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting Medium

February 14, 2024 Patched in ["4.6.2"] CVE-2023-50905

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Medium

July 18, 2023 Patched in ["4.4.3"] CVE-2023-33999

WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup Medium

May 17, 2023 Patched in ["4.5.2"] CVE-2023-2286

WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration Medium

May 17, 2023 Patched in ["4.5.2"] CVE-2023-2261

Freemius SDK <= 2.4.2 - Missing Authorization Checks Medium

March 4, 2022 Patched in ["4.4.0"] CVE-2022-4974

WP Activity Log <= 4.1.4 - SQL Injection Critical

November 4, 2020 Patched in ["4.1.5"]

WP Activity Log <= 4.0.1 - Missing Authorization High

March 8, 2020 Patched in ["4.0.2"] CVE-2020-36716

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update High

February 25, 2019 Patched in ["3.3.1.2"]

WP Security Audit Log <= 3.1.1 - Sensitive Information Disclosure Medium

March 28, 2018 Patched in ["3.1.2"] CVE-2018-8719

WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting High

June 27, 2016 Patched in ["2.4.4"]

WP Activity Log <= 1.2.4 - Cross-Site Request Forgery High

August 1, 2014 Patched in ["1.2.5"] CVE-2014-5072

What It Does

WP Activity Log is a comprehensive event logging plugin that records virtually every change and action on a WordPress site, from content edits and user logins to plugin activations and failed access attempts. It provides a searchable audit trail viewable directly in the WordPress dashboard, with options for email alerts, reports, and integrations with external services like Slack and PagerDuty.

Who It's For

This plugin is best suited for agencies managing multiple client sites, multi-author content teams, e-commerce stores with PCI or GDPR obligations, and any organization that needs documented proof of who changed what and when. It is particularly valuable for compliance-driven environments where audit trails are not optional.

Who Should Skip It

Personal blogs, simple brochure sites, and small sites with a single trusted administrator will likely find this plugin overkill, since there is little to log and the interface adds admin noise they do not need.

The Bottom Line

WP Activity Log is the strongest all-around WordPress activity logging plugin available, with proven scale, excellent maintenance, and high user ratings. The only meaningful weak spot is support health, where the smaller sample of resolved threads leaves some uncertainty. For any site that takes accountability, troubleshooting, or compliance seriously, this plugin is a sound investment.

Related Plugins

Simple History 87/100

Pick Simple History if you want a lighter, developer-friendly activity log with less configuration overhead and no premium upsell pressure.

Activity Log 84/100

Pick Activity Log when you need basic user change tracking on a smaller site and prefer a simpler interface with fewer features to manage.

Timeline Widget For Elementor 84/100

This is a frontend timeline display widget for Elementor rather than a security audit tool, so it is only relevant if you want to render timeline visuals on pages.

Shield Security 83/100

Pick Shield Security if your primary concern is active hardening, brute-force blocking, and malware scanning rather than detailed activity logging.

Cool Timeline 81/100

Cool Timeline is a frontend storytelling widget, not an admin audit tool, and only makes sense if you want to display timeline content to visitors.