CVE-2025-31823: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in wpoperations WPoperation Elementor Addons affecting versions through 1.1.9. The vulnerability was reported by João Pedro Soares de Alcântara on September 25, 2024, and was officially published on April 1, 2025 with the identifier CVE-2025-31823 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires Contributor or higher level privileges to exploit (NVD, Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability has been classified as having a low severity impact and is considered unlikely to be exploited. It requires authenticated access with at least Contributor-level privileges to execute the attack (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects versions through 1.1.9 of the WPoperation Elementor Addons plugin (Patchstack).