The vulnerability identified as CVE-2025-28981 affects the Soli WP Mail Options WordPress plugin (versions <= 0.2.3). It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation of this vulnerability can allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions within the affected WordPress plugin environment. This can result in limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Additionally, applying standard CSRF protections and restricting user permissions may reduce exposure. Monitor official Soli or WP Mail Options advisories for updates.