The vulnerability CVE-2025-31463 in the TGG WP Optimizer plugin involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). This allows an attacker with high privileges and requiring user interaction to inject malicious scripts that could impact confidentiality, integrity, and availability to a limited extent. The affected versions are from initial releases through version 1.25. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and scope changed, with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of users viewing the affected pages, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and elevated privileges, which limits the overall risk. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor or security advisories. Until a fix is available, restrict high-privilege user access and be cautious with user-generated content to reduce exposure.