The vulnerability CVE-2025-31608 in reDim GmbH's CookieHint WP plugin allows stored cross-site scripting due to improper input neutralization during web page generation. This enables an attacker with low privileges to inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability. The affected versions include all up to 1.0.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score of 6.5. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting privileges for users who can input data into the plugin and limit exposure to untrusted users. Avoid relying on this plugin version in sensitive environments.