CVE-2025-31436 is a reflected cross-site scripting vulnerability in the Blubrry PowerPress Podcasting plugin MultiSite add-on developed by Angelo Mandato. The issue stems from improper input neutralization during web page generation, which can allow attackers to inject malicious scripts that execute in users' browsers when they interact with crafted URLs or inputs. This vulnerability affects versions up to 0.1.1 of the plugin. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 indicates a high severity level with impacts on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor the vendor's communications for updates. In the meantime, limiting exposure by restricting access to the affected plugin or disabling it if feasible may reduce risk.