The vulnerability CVE-2025-31772 in Astoundify WP Modal Popup with Cookie Integration is a stored cross-site scripting flaw caused by improper input sanitization during web page generation. This allows attackers with high privileges to inject malicious scripts that persist and execute when other users load the affected content. The affected plugin versions are from initial releases up to 2.4. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. No known exploits or patches have been reported yet.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users who view the affected modal popups, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict high-privilege user access to trusted individuals only and monitor for unusual activity related to modal popup content. Avoid using the affected plugin versions if possible.