The vulnerability CVE-2025-31597 in crazycric's Ultimate Live Cricket WordPress Lite plugin allows stored cross-site scripting due to improper input neutralization during web page generation. This affects versions up to 1.4.2. The vulnerability requires low attack complexity, privileges, and user interaction, and can impact confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of availability within the affected WordPress environment. The impact is rated medium based on the CVSS score of 6.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's input interfaces and monitoring for suspicious activity related to stored XSS attempts. Avoid installing or updating to affected versions if possible.