This vulnerability (CVE-2025-31889) in petesheppard84 Extensions for Elementor is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as cross-site scripting (XSS). It affects all versions up to 2.0.40. The CVSS 3.1 base score is 6.5, indicating a medium severity level. The attack vector is network-based, with low attack complexity, requiring privileges and user interaction. Successful exploitation could lead to partial confidentiality, integrity, and availability impacts. No patch or official remediation level has been published, and no known exploits have been reported.

The vulnerability allows an attacker with low privileges and requiring user interaction to inject malicious scripts during web page generation, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, the impact is limited by the need for user interaction and the attacker's privileges. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying any available temporary mitigations recommended by the vendor or security community. Monitor for updates from petesheppard84 regarding a patch or official remediation.