This vulnerability, identified as CWE-201, affects WP Zone's Custom CSS and JavaScript plugin versions <= 2.0.16. It allows unauthenticated attackers to access sensitive information that is inserted into data sent by the plugin. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality only. No official patch or remediation guidance is currently available from the vendor or advisory sources.

The vulnerability exposes sensitive information to unauthenticated attackers, potentially leading to information disclosure. There is no impact on data integrity or availability. Exploitation does not require privileges or user interaction, increasing the risk of exposure. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are documented.