This vulnerability in Melapress WP Activity Log arises from improper neutralization of input during web page generation, enabling DOM-based cross-site scripting (CWE-79). It affects versions through 5.6.3 and has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The attack vector is network-based with low attack complexity, requiring privileges and user interaction, and can impact confidentiality, integrity, and availability in a limited manner. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a user's browser session, potentially leading to limited disclosure of information, modification of data, or disruption of service within the affected plugin environment. The CVSS vector indicates partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to the affected plugin or applying web application firewall rules to detect and block suspicious input patterns related to DOM-based XSS. Avoid relying on generic mitigations unless specifically recommended by the vendor.