The WP Database Optimizer plugin for WordPress, maintained by matthewprice1178, contains a stored cross-site scripting vulnerability identified as CVE-2025-31473. This vulnerability is due to improper neutralization of input during web page generation, which can allow an attacker with high privileges and requiring user interaction to inject malicious scripts. The affected versions include all versions up to 1.2.1.3. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and store malicious scripts that execute when other users view affected pages. This can lead to partial compromise of confidentiality, integrity, and availability within the affected WordPress environment. However, exploitation requires user interaction and high privileges, limiting the ease of attack. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users with high privileges and limit exposure. Monitor for updates from the vendor or security advisories for a patch or official mitigation steps.