WP Activity Log CVE-2026-120075

Exploitation requires that the attacker's unsanitized input be stored and then rendered on a page a user subsequently views; the payload executes only when that page is accessed, so a victim page-view is the practical trigger even though CVSS records UI:N for the injection step. The description attributes the flaw to insufficient input sanitization and output escaping but does not name the exact parameter, field, or plugin feature that is injectable - the specific trigger is not described in the available sources. Injection itself needs no authentication (PR:N) and no special non-default configuration is stated; the main limiting factor is that impact materializes against whichever user opens the injected page, which for an activity-log plugin is most plausibly an authenticated administrator reviewing logs. Affected: all versions up to and including 5.6.1.

This is a genuinely elevated-but-not-emergency issue. The CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C) signals network-reachable, low-complexity injection by an unauthenticated attacker (PR:N) with a scope change (S:C) reflecting that injected script executes in the context of other users who view the page, but impact is capped at C:L/I:L/A:N - partial confidentiality and integrity, no availability effect - which is typical for stored XSS rather than full system compromise. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious web-application flaw that warrants prompt patching but is not under confirmed mass exploitation. Key signals are MISSING or weak: the input provides no EPSS score, no CISA KEV listing, and no confirmed public exploit code, so there is no evidence of active exploitation - only a Wordfence advisory and a CleanTalk research reference. The one notable tension is PR:N (unauthenticated injection) combined with the plugin being a security-audit/logging tool: stored XSS in a logging plugin often lands in an admin-facing log viewer, meaning the most likely victim is a privileged user - which raises real impact even though raw availability is unaffected. Net: a real priority to patch within the week, not a low-real-risk high-CVSS artifact, but also not a confirmed in-the-wild emergency.

An unauthenticated attacker submits input that the plugin stores without sufficient sanitization; because AV:N/AC:L/PR:N/UI:N, no account or user trickery is needed to plant the payload. The malicious script is later rendered unescaped when a user - plausibly a WordPress administrator reviewing the activity log - opens the affected page, executing attacker-controlled JavaScript in that user's authenticated session (S:C). No public exploit code is identified at time of analysis.