This vulnerability involves improper neutralization of input during web page generation in the Melapress WP Activity Log plugin, leading to a DOM-based Cross-site Scripting (XSS) issue. It affects versions up to 5.5.4. The CVSS vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory details are currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. This could result in unauthorized actions performed on behalf of the user or exposure of sensitive information within the affected application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with this plugin and consider disabling it if possible or limiting access to trusted users only. Monitor the vendor's communications for updates on patches or official mitigations.