The vulnerability CVE-2025-31922 involves a CSRF flaw in the CSS3 Accordions plugin by QuanticaLabs for WordPress, which can be exploited to inject stored XSS payloads. This affects all versions up to 3.0. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. Successful exploitation can lead to a partial loss of confidentiality, integrity, and availability of the affected system. The plugin is cloud-hosted, and the vendor manages remediation for this service. A patch is available to address this issue.

Exploitation of this vulnerability can allow attackers to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions on behalf of authenticated users, data compromise, and disruption of service. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability.

A patch is available for this vulnerability. Since the product is a cloud-hosted WordPress plugin, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or apply the patch if managing their own instance. Patch status is confirmed as available.