This vulnerability in stilleshan ServerStatus 1.0 and 2.0 allows remote attackers to perform cross-site scripting by manipulating the 'custom' argument in the Stats Generation component (server/src/main.cpp). The vulnerability is confirmed public with exploit code available. The vendor has not issued any response or patch. The CVSS 4.0 score is 5.1, indicating medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and low privileges but can be initiated remotely. No direct evidence of active exploitation in the wild is reported.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure. Users should monitor vendor channels for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'custom' argument to mitigate exploitation risk.