The WP Activity Log WordPress plugin is vulnerable to stored cross‑site scripting due to insufficient input sanitization and output escaping, allowing an unauthenticated attacker to inject arbitrary scripts that execute in visitors’ browsers. This results in potential theft of session data, defacement, or other client‑side attacks without requiring user login. The weakness is classified as CWE‑79.

The vulnerability affects the WP Activity Log plugin from Melapress, all versions up to and including 5.6.1. No other product or version information is listed.

With a CVSS score of 7.2 the vulnerability has a medium‑high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication, likely via crafted URLs or form inputs that the plugin records and later displays. The impact spans site visitors who load the affected content.