The vulnerability CVE-2025-31451 in kevinweber wBounce (versions <= 1.8.1) is a stored cross-site scripting issue caused by improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting medium severity. No known exploits in the wild or patch information is currently available.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system. An attacker could execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions. However, exploitation requires low privileges and user interaction, which somewhat limits the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to trusted users and monitoring for suspicious activity related to input handling in wBounce. Avoid exposing the vulnerable functionality to untrusted users where possible.