The vulnerability identified as CVE-2025-31443 affects the KK I Like It plugin by Krzysztof Furtak. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The affected versions include all releases up to 1.7.5.3. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability all rated low to high. No patch or official fix information is available from the vendor or other sources.

Successful exploitation of this vulnerability could allow an attacker to trick authenticated users into submitting forged requests, which may result in stored XSS attacks. This can lead to unauthorized actions performed with the user's privileges, potential data exposure, and disruption of service. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin and applying any recommended security controls to mitigate CSRF and XSS risks, such as implementing strict Content Security Policies and verifying user actions with additional authentication steps.