WP Activity Log plugin for WordPress is vulnerable to stored cross‑site scripting via the 'message' parameter in all versions up to 5.2.2. The vulnerability originates from insufficient input sanitization and output escaping. An unauthenticated attacker can submit malicious content through the 'message' field, which is then stored and rendered unescaped in alert pages, allowing a browser to execute the injected script when a user accesses an affected page.

The flaw affects installations of the Melapress WP Activity Log plugin version 5.2.2 or earlier on WordPress websites. Any WordPress site that has deployed one of these plugin releases is at risk.

The CVSS score of 7.2 indicates moderate severity, and the EPSS score of 6% denotes a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely reported as actively exploited. An unauthenticated attacker can exploit the flaw by submitting malicious content into the exposed 'message' parameter; the payload is stored and subsequently rendered unescaped in alert pages. Because the script is persisted, any user who views the affected page can be impacted.