CVE-2025-31778 describes a reflected cross-site scripting vulnerability in the Donate Me plugin by raphaelheide, affecting versions up to 1.2.5. The issue stems from improper input neutralization during web page generation, enabling attackers to inject malicious scripts that execute in the context of a victim's browser. The CVSS 3.1 base score of 6.5 reflects a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts to confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The vulnerability requires user interaction and some privileges, limiting but not eliminating risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and avoid exposing the vulnerable plugin publicly if possible.