CVE-2025-3099 is a CSRF vulnerability in the Advanced Search by My Solr Server WordPress plugin (up to version 2.0.5). The issue arises from missing or incorrect nonce validation on the 'MySolrServerSettings' page, enabling attackers to forge requests that update plugin settings and inject malicious web scripts if an administrator is tricked into performing an action. The vulnerability is remotely exploitable without authentication but requires user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can exploit this vulnerability to change plugin settings and inject malicious scripts by tricking an authenticated administrator into performing an action such as clicking a crafted link. This can lead to partial compromise of site integrity and confidentiality. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links and consider restricting access to the plugin settings page. Monitoring vendor channels for updates is recommended.