The Custom Field Suite plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. The flaw exists in the handling of the 'cfs[fields][*][name]' parameter, which is not properly sanitized or escaped before being stored and rendered. This allows authenticated administrators on multi-site or restricted unfiltered_html installations to inject malicious scripts that execute in the context of users viewing the injected pages. The vulnerability affects all versions up to and including 2.6.5. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, required high privileges, no user interaction, and limited confidentiality and integrity impact.

An attacker with administrator-level access on affected WordPress multi-site installations or where unfiltered_html is disabled can inject persistent malicious scripts. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires high privileges and is not exploitable by unauthenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict administrator access to trusted users only and consider disabling or limiting use of the Custom Field Suite plugin in multi-site environments or where unfiltered_html is disabled. Monitoring for plugin updates from the vendor mgibbs189 is recommended to apply any forthcoming patches promptly.