This vulnerability involves improper neutralization of input in the WP Customize Login Page plugin, leading to stored cross-site scripting (XSS). An attacker with high privileges (PR:H) and requiring user interaction (UI:R) can exploit this vulnerability remotely (AV:N) to cause a partial impact on confidentiality, integrity, and availability (C:L/I:L/A:L). The affected versions include all releases up to 1.6.5. No official patch or remediation details have been provided yet.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that persist on the login page, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and high privileges, limiting the attack scope. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's configuration to trusted administrators only and monitor for suspicious activity related to login page customization. Avoid exposing the login page customization interface to untrusted users.