This vulnerability in the Webriti Custom Login plugin (versions <= 0.3) allows an attacker to exploit Cross-Site Request Forgery (CSRF) combined with reflected Cross-Site Scripting (XSS). The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and results in a partial compromise of confidentiality, integrity, and availability. The plugin does not currently have a known patch or official fix published, and no exploits are known to be in the wild at this time.

Successful exploitation could allow an attacker to trick an authenticated user into executing unwanted actions on the vulnerable web application, potentially leading to partial disclosure of information, modification of data, and disruption of service. The reflected XSS component may enable execution of malicious scripts in the context of the victim's browser, further compromising user security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or replacing the Webriti Custom Login plugin to mitigate risk. Implementing standard CSRF protections and input validation may reduce exposure but are not confirmed as effective for this specific vulnerability.