This vulnerability in the Custom Field Template plugin by Hiroaki Miyashita allows an attacker to inject and store malicious scripts due to improper input sanitization during web page generation. When a user views the affected page, the stored script can execute, potentially leading to information disclosure, session hijacking, or other impacts typical of stored XSS. The issue affects all versions up to 2.7.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with scope changed and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or manipulate displayed content. The impact is rated as medium severity based on the CVSS score of 6.5. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding workarounds if feasible. Monitor vendor channels for updates and apply patches promptly once released.