The vulnerability in the Melapress WP Activity Log plugin is an improper neutralization of input during web page generation, allowing DOM‑based cross‑site scripting. An attacker can inject malicious JavaScript that will execute in the browser of any user who views a compromised page, potentially compromising session cookies, defacing content, or redirecting traffic. This flaw represents a CWE‑79 weakness in input handling.

WordPress sites that use the Melapress WP Activity Log plugin version 5.5.4 or earlier are affected. The vulnerability applies to all installations where the plugin is active, regardless of WordPress configuration or site role permissions.

The CVSS score of 6.5 indicates moderate severity; however, the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure a victim to a specially crafted page rendered by the plugin, after which the injected script runs client‑side. Because there is no known authentication bypass, the impact is limited to the victim’s browser, but the potential for phishing or credential theft remains significant.