This vulnerability (CVE-2024-25919) involves improper neutralization of input in the Custom Field Template plugin by Hiroaki Miyashita, leading to stored cross-site scripting (CWE-79). It affects versions up to 2.6 and allows an attacker with low privileges to inject malicious scripts that execute when other users view the affected pages. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability requires low privileges and user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected plugin or disabling it if feasible. Monitor for updates from the vendor or trusted security sources regarding patches or mitigations.