Vendor
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.6.1 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts.