The WP Ultimate Search plugin for WordPress, developed by Mindshare Labs, Inc., contains a stored cross-site scripting vulnerability identified as CVE-2025-31452. This vulnerability is due to improper input neutralization during web page generation, which can allow an attacker to inject and store malicious scripts that execute when viewed by other users. The affected versions include all releases up to 2.0.3. The vulnerability requires network access, low attack complexity, low privileges, and user interaction, and it impacts confidentiality, integrity, and availability to a limited extent as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.

Successful exploitation of this vulnerability could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to information disclosure, modification of data, or disruption of service. The impact is limited to confidentiality, integrity, and availability at a low level. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting plugin usage to trusted users and monitoring for suspicious activity related to this plugin. Avoid exposing the plugin to untrusted users if possible.