CVE-2025-28981
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the WP Mail Options WordPress plugin (versions up to 0.2.3) that allows an attacker to perform Stored Cross-Site Scripting (XSS). An attacker can trick authenticated users with higher privileges into executing unauthorized actions, which can result in malicious scripts being injected and stored within the application. This can happen without the attacker needing to be authenticated themselves. [1]
How can this vulnerability impact me? :
The impact of this vulnerability includes the potential for attackers to inject malicious scripts that persist in the application, which can lead to unauthorized actions being executed by privileged users. This can compromise the confidentiality, integrity, and availability of the affected system. Since the vulnerability allows Stored XSS, it can be used to steal sensitive information, hijack user sessions, or perform other malicious activities. However, the severity is considered low and exploitation is unlikely to be widespread. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official patch or fixed version is currently available for this vulnerability, immediate mitigation steps include applying virtual patching (vPatching) solutions offered by Patchstack to provide automatic protection. Additionally, users should monitor for updates and consider restricting access or privileges to reduce risk until an official fix is released. [1]