CVE-2025-39414 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Mike spam-stopper software, versions up to 3.1.3. The vulnerability enables stored Cross-Site Scripting (XSS) attacks by allowing an attacker to trick an authenticated user into submitting unauthorized requests. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no exploits have been observed in the wild. The product is not cloud-hosted, so remediation depends on vendor patch releases or user intervention.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of an authenticated user. This may result in partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying additional CSRF protections or disabling vulnerable features if possible.