This vulnerability involves a CSRF flaw in the phpdevp Admin Customization plugin that enables stored XSS attacks. An attacker could trick an authenticated administrator into submitting a crafted request, resulting in malicious script storage and execution within the admin interface. The affected versions are up to 2.2. The CVSS vector indicates the attack can be performed remotely with low attack complexity and no privileges but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of an administrator's session, potentially leading to unauthorized actions, data exposure, or disruption of service. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, administrators should exercise caution with links and requests that could trigger CSRF attacks and consider implementing additional CSRF protections at the web server or application firewall level if possible.