CVE-2025-31455 describes a DOM-based cross-site scripting vulnerability in the ralxz Limit Max IPs Per User plugin (versions ≤ 1.5). The issue arises from improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts that execute in the context of a victim's browser. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to information disclosure, modification of data, or disruption of service within the context of the affected web application. The impact is limited to the scope of the affected plugin and the users interacting with it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the affected plugin to mitigate risk. Avoid clicking on untrusted links that may trigger the vulnerability.