Improper neutralization of input during page generation leads to reflected cross‑site scripting in the WP Log Action plugin. CWE‑79 applies because the plugin fails to encode or filter user‑supplied data that is subsequently rendered in a browser. An attacker can inject malicious JavaScript that executes in the context of site visitors, potentially stealing authentication cookies, defacing the page, or redirecting users to malicious sites.

The vulnerability affects the WordPress WP Log Action plugin, developed by webheadcoder, for all supported versions from n/a through 0.51. Users of any release of this plugin before the recommended update are at risk.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% signifies a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, reflected XSS can be triggered via a crafted URL or form submission that the plugin echoes back without proper escaping, making the threat realistic for sites that allow arbitrary input. Mitigation should be applied promptly to avoid client‑side attacks.