CVE-2025-0924 is a stored cross-site scripting vulnerability in the WP Activity Log WordPress plugin by melapress. The issue exists in the 'message' parameter due to improper neutralization of input during web page generation, allowing injection of malicious scripts that execute in the context of users viewing the injected content. This affects all versions up to and including 5.2.2. The vulnerability has a CVSS v3.1 base score of 7.2, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with a scope change. No patch or official fix details are currently available.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users accessing the affected pages, potentially leading to data disclosure or manipulation within the affected WordPress environment. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the WP Activity Log plugin, especially for untrusted users, and monitor for suspicious activity related to injected scripts. Avoid interacting with untrusted input in the 'message' parameter. Follow updates from melapress for official patches or mitigations.