This vulnerability involves improper input sanitization in the SaifuMak Add Custom Codes plugin, which allows stored cross-site scripting attacks. Attackers can inject malicious scripts that persist in the application and execute when viewed by other users. The CVSS vector indicates the attack requires network access, low attack complexity, high privileges, user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or official fix information is provided in the available data.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The medium severity score reflects these moderate risks. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict high privilege access to trusted personnel and consider disabling or limiting use of the vulnerable plugin. Monitor vendor channels for updates and apply patches promptly once released.