The vulnerability in the Melapress WP Activity Log plugin allows an attacker to store malicious script code in log entries. This stored Cross‑Site Scripting flaw results in arbitrary client‑side code injection when a user views the affected log page, potentially compromising the confidentiality and integrity of the logged session and enabling phishing or credential theft. The weakness is a classic input sanitization failure, categorized as CWE-79.

WordPress installations that use the Melapress WP Activity Log plugin, specifically any release through version 5.6.7, are affected. The issue has no version restriction beyond 5.6.7, meaning all backported releases prior to that identify as vulnerable.

The CVSS score of 6.5 places the vulnerability in a medium‑high severity range, while the EPSS score is not reported, suggesting no publicly available exploitation data at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, indicating that it has not yet been identified as a widely exploited or actively exploited vulnerability. Exfiltration or credential theft can be achieved via browsers that render the injected script, and the attack is likely to proceed through a vulnerable user with access to the affected log pages. Proper input validation or output encoding would mitigate the risk.