The Breaking News WP plugin for WordPress, developed by doit, contains a stored cross-site scripting vulnerability identified as CVE-2025-31750. This vulnerability is due to improper input neutralization during web page generation, which can allow an attacker with high privileges and requiring user interaction to inject malicious scripts that affect confidentiality, integrity, and availability to a limited extent. The issue affects versions up to 1.3. No patch or official fix information is currently available.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and privileges, reducing the risk compared to lower privilege or no interaction vulnerabilities. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access to trusted users only and monitor for suspicious activity related to the Breaking News WP plugin. Avoid enabling untrusted users to input content that is rendered by the plugin.