This vulnerability in merzedes Custom Style (<= 1.0) allows an attacker to exploit a CSRF weakness to inject stored XSS payloads. The CVSS 3.1 score of 7.1 indicates a high-severity issue with network attack vector, low attack complexity, no privileges required, user interaction needed, and scope changed. The impact includes limited confidentiality, integrity, and availability loss. No known exploits are reported in the wild, and no patch or vendor advisory is available at this time.

Successful exploitation can lead to stored XSS via CSRF, potentially allowing attackers to execute malicious scripts in the context of affected users. This can result in limited compromise of user data and application integrity, as well as partial availability impact. The vulnerability affects all users who interact with the vulnerable application version and perform actions requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk of stored XSS via CSRF. Monitor official vendor channels for updates and patches.