CVE-2025-13360: 
WordPress vulnerability analysis and mitigation

CVE-2025-13360 is a Cross-Site Request Forgery (CSRF) vulnerability in the Quantic Social Image Hover plugin for WordPress, affecting all versions up to and including 1.0.8. The flaw allows unauthenticated attackers to update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. It was published on December 5, 2025, and assigned by Wordfence. The CVSS v3.1 base score is 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing nonce validation on the plugin's settings update functionality (CWE-352: Cross-Site Request Forgery). Because the settings endpoint does not verify a WordPress nonce, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, updates plugin settings and injects arbitrary JavaScript or HTML — effectively achieving stored XSS through the CSRF vector. Exploitation requires no privileges but does require user interaction (the administrator must click a malicious link or visit an attacker-controlled page). The vulnerable code is visible in the plugin's source at line 103 of tw-image-hover.php (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to modify the Quantic Social Image Hover plugin's settings and inject malicious scripts into the WordPress site, resulting in stored XSS that affects all visitors of the compromised site. The primary impact is on integrity (script injection), with no direct confidentiality or availability impact per the CVSS assessment. Injected scripts could be used to steal session cookies, redirect users to phishing pages, or perform further attacks against site visitors (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Quantic Social Image Hover plugin (slug: tw-image-hover-share) at version 1.0.8 or earlier, using tools like WPScan or passive enumeration.
2. Craft forged request: Create a malicious HTML page or link containing a form that submits a POST request to the target WordPress site's admin-ajax or settings endpoint for the plugin, with attacker-controlled values (e.g., injecting a <script> tag into a plugin setting field).
3. Social engineering: Deliver the malicious link or page to a logged-in site administrator via email, comment, or other channel, inducing them to click or visit it.
4. CSRF triggers settings update: The administrator's browser automatically sends the forged request with their authenticated session cookies, bypassing CSRF protection due to the missing nonce check.
5. Stored XSS execution: The injected script is saved in the plugin settings and subsequently executed in the browsers of site visitors or administrators who view affected pages (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to plugin settings endpoints (e.g., admin-ajax.php or plugin-specific admin pages) from unusual referrers or external origins.
• File System: Unexpected or modified plugin settings stored in the WordPress database (wp_options table) containing <script> tags or encoded JavaScript payloads in Quantic Social Image Hover plugin options.
• Network: Outbound connections from site visitors' browsers to unknown external domains following page loads on the affected WordPress site (indicative of injected script execution).
• Logs: WordPress debug logs or server error logs showing unusual form submissions or admin actions not correlated with legitimate administrator activity.

Users should update the Quantic Social Image Hover plugin to version 1.0.9 or later, which includes proper nonce validation on the settings update functionality. As an interim workaround, administrators can deactivate and remove the plugin until the update can be applied. Restricting access to the WordPress admin panel via IP allowlisting can also reduce the attack surface (Wordfence).