CVE-2025-31899 describes a reflected Cross-site Scripting (XSS) vulnerability in the wpshopee Awesome Logos WordPress plugin versions up to 1.2. The vulnerability is due to improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that execute when a user views a crafted page. The CVSS 3.1 base score is 7.1 (High), with attack vector Network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low to low. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability at a low level. The scope of impact extends beyond the vulnerable component due to the changed scope in CVSS, indicating potential broader effects within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Implementing web application firewalls (WAFs) that detect and block reflected XSS attempts may provide temporary protection.