The vulnerability CVE-2025-31007 involves improper neutralization of input in the Billplz Addon for Contact Form 7 plugin by Alvind, leading to reflected cross-site scripting (XSS). This affects versions up to 1.2.0. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The issue allows an attacker to inject malicious scripts that execute in the context of a user's browser when they interact with crafted input, potentially compromising user data or session integrity.

Successful exploitation of this vulnerability can result in execution of arbitrary scripts in the victim's browser, leading to partial compromise of confidentiality, integrity, and availability of affected users' data or sessions. The reflected XSS could be used to steal cookies, perform actions on behalf of the user, or deliver malicious payloads. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, users should monitor for updates from the vendor. As a temporary mitigation, consider restricting or sanitizing user inputs that interact with the vulnerable addon or disabling the addon until a fix is available.