CVE-2025-31465: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Better Section Navigation Widget WordPress plugin through version 1.6.1. The vulnerability was assigned CVE-2025-31465 and was disclosed on March 28, 2025. This security issue affects the cornershop Better Section Navigation Widget plugin and allows for Stored XSS attacks (Patchstack Database).

The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) with a CVSS v3.1 score of 6.5 (Medium). The attack vector requires network access (N), low attack complexity (L), low privileges (L), user interaction (R), and has changed scope (C) with low impacts to confidentiality, integrity, and availability (NVD).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack Database).

The vulnerability has been patched in version 1.7.0 of the Better Section Navigation Widget plugin. Users are advised to update to version 1.7.0 or later to remove the vulnerability (Patchstack Database).