CVE-2025-31464 describes a Stored Cross-site Scripting (XSS) vulnerability in the Nazmur Rahman Text Selection Color software, versions up to 1.6. The issue is caused by improper neutralization of input during web page generation, which allows an attacker with high privileges to inject malicious scripts that are stored and later executed when viewed by users. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability at a low level. There is no vendor advisory or patch information available at this time, and no known active exploitation has been reported.

The vulnerability allows an attacker with high privileges to inject stored malicious scripts into the application, which can be executed in the context of other users. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and high privileges, limiting the ease of attack. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor for vendor updates. Until a fix is available, restricting high privilege access and minimizing user interaction with untrusted content may reduce risk.