The vulnerability identified as CVE-2025-31032 affects the Pagopar – WooCommerce Gateway plugin by Grupo M S.A. It is a Cross-Site Request Forgery (CSRF) issue that enables stored XSS attacks. The affected versions are up to and including 2.7.1. The CVSS score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability could allow an attacker to trick a user into submitting unauthorized requests that result in malicious script storage within the application context.

Successful exploitation of this vulnerability could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of the victim user. This can compromise user data confidentiality, integrity, and availability within the affected WooCommerce environment. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Pagopar – WooCommerce Gateway plugin or limiting its use to trusted environments. Monitor vendor channels for updates and apply patches promptly once available.