Improper neutralization of input during page rendering allows an attacker to inject and execute malicious JavaScript in the context of a victim’s browser. The DOM‑based XSS flaw permits a malicious script to run when a user views the affected plugin’s interface, potentially leading to session hijacking, credential theft, defacement, or the execution of arbitrary actions with the victim’s privileges.

The vulnerability impacts the Melapress WordPress plugin WP Activity Log version 5.6.3 and all earlier releases.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, and the issue is not listed in CISA KEV. Because the flaw is DOM‑based, an attacker would likely need to supply crafted input to a page that renders the affected plugin’s data; the precise access conditions are not detailed in the advisory, so the presence of authentication or elevated privileges is inferred but not confirmed. The attack would require the victim’s interaction with the malicious page to trigger the exploit.