This vulnerability involves improper input sanitization in the Comment Form WP – Customize Default Comment Form plugin by Habibur Rahman, which allows an attacker with high privileges and user interaction to inject stored malicious scripts via the comment form. The vulnerability affects all versions up to 2.0.1. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation information is provided in the data.

Successful exploitation could allow an attacker to execute stored cross-site scripting attacks, potentially leading to unauthorized actions in the context of affected users, including data disclosure, modification, or disruption of availability. The impact is rated as medium severity with low confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to the comment form and consider disabling or limiting the use of the affected plugin to reduce exposure. Monitor for vendor updates or security advisories for a patch or official mitigation steps.