This vulnerability in YITH Custom Login plugin (versions <= 1.7.0) involves improper neutralization of input during web page generation, resulting in a cross-site scripting (XSS) flaw. The CVSS 3.1 base score is 5.9 (medium), with network attack vector, low attack complexity, requiring privileges and user interaction, and causing partial impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker with some privileges and requiring user interaction to execute malicious scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited by the need for privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit privileges to trusted users and avoid actions that could trigger the vulnerability. Monitor official YITHEMES channels for updates and apply patches promptly once released.