The flaw is a subscriber‑level cross‑site scripting vulnerability in WP Activity Log plugin versions up to 5.6.3.1. It allows an attacker to inject arbitrary JavaScript through user‑controlled input that is displayed in the activity log view. The impact is the execution of malicious scripts in the context of users who view the log, potentially leading to credential theft or defacement.

The affected software is the WordPress WP Activity Log plugin from Melapress, with all releases up to but not including 5.6.4 vulnerable. Any WordPress installation that has a version of this plugin older than 5.6.4 should be considered at risk.

With a CVSS score of 7.1 this vulnerability is considered high severity. The EPSS score is not available, making the exact exploitation likelihood uncertain, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through the WordPress web interface targeting users with the subscriber role who can view the activity log. Successful exploitation would enable an attacker to run arbitrary JavaScript within the victim’s browser context.