This vulnerability in the Unreal Themes ACF: Yandex Maps Field plugin (versions <= 1.1) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction can inject malicious scripts that may lead to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, indicating network exploitation with low complexity but requiring high privileges and user interaction.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of other users, potentially leading to partial disclosure of information, modification of data, and disruption of service. The impact is limited by the requirement for high privileges and user interaction, and the scope is changed (S:C) indicating some privilege boundaries may be crossed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege users and limit exposure to untrusted input in the affected plugin. Monitor vendor channels for updates and apply patches promptly once released.