WordPress security by component

Stream – Activity Log & Audit Trail

Plugin description

Stream – Activity Log & Audit Trail records WordPress user and administrator activities in an activity log for reviewing changes and events.

Stream – Activity Log & Audit Trail (stream) is a WordPress plugin with 7 published CVE records in this archive. The latest tracked vulnerability was published Aug 07, 2026; the highest published CVSS base score is 8.8.

Plugin slug: stream

Latest vulnerability

CVE-2026-11907: Stream Heartbeat handler exposes audit records to Subscribers

Stream through 4.2.0 lets any logged-in user, including a Subscriber, submit wp-stream-heartbeat live-update and query data through WordPress Heartbeat. Live_Update::heartbeat_received() constructs the Stream List_Table, calls prepare_items() and returns record counts and activity without checking the capability required to view Stream. Version 4.2.1 adds current_user_can($this->plugin->admin->view_cap) before records are prepared.

PublishedAug 07, 2026

Known safe version4.2.1

Published vulnerabilities for stream
		Safe version
Aug 07, 2026	CVE-2026-11907 Stream Heartbeat handler exposes audit records to Subscribers Stream through 4.2.0 lets any logged-in user, including a Subscriber, submit wp-stream-heartbeat live-update and query data through WordPress Heartbeat. Live_Update::heartbeat_received() constructs the Stream List_Table, calls prepare_items() and returns record counts and activity without checking the capability required to view Stream. Version 4.2.1 adds current_user_can($this->plugin->admin->view_cap) before records are prepared.	4.2.1	CVE6.5 NVDPending
Feb 17, 2025	CVE-2024-13879 Stream: Server-side request forgery Stream is affected by server-side request forgery. Exploitation requires an authenticated administrator account. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE5.5 NVDPending
Sep 13, 2024	CVE-2024-7423 Stream: Privilege escalation or authentication bypass Stream is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.8 NVDPending
Dec 19, 2023	CVE-2022-43450 Stream: A security weakness Stream is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVD6.5
May 25, 2023	CVE-2022-43490 Stream: Cross-site request forgery Stream is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.4 NVD8.8
Feb 06, 2023	CVE-2022-4384 Stream: A security weakness Stream is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVD6.5
Nov 17, 2021	CVE-2021-24772 Stream: SQL injection Stream is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD8.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers