CVE-2024-0653 is a stored cross-site scripting vulnerability in the Custom Field Template plugin for WordPress, present in all versions up to 2.6.1. The vulnerability arises from insufficient input sanitization and output escaping in the plugin's admin settings, allowing authenticated users with administrator-level permissions to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages. The issue affects multi-site WordPress installations or installations where the unfiltered_html capability is disabled. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality and integrity impact with no availability impact.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability is limited to multi-site or restricted HTML capability environments and requires high privileges, reducing the overall risk.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Custom Field Template plugin in multi-site or unfiltered_html-disabled environments to mitigate risk.