The WP Post Modules for Elementor plugin by SaurabhSharma contains a reflected cross-site scripting vulnerability identified as CVE-2025-31636. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be reflected back to users. It affects all versions up to 2.5.0. The CVSS 3.1 base score is 7.1, indicating a high severity vulnerability exploitable remotely without privileges but requiring user interaction. No patch or official remediation information is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser. This may lead to information disclosure, session hijacking, or other impacts related to reflected XSS attacks. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (C:L/I:L/A:L). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin versions or applying any recommended temporary mitigations from the vendor. Avoid clicking on suspicious links that could trigger reflected XSS payloads in the affected plugin context.