CVE-2025-13360: Quantic Social Image Hover CSRF Flaw

CVE-2025-13360 Overview

CVE-2025-13360 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Quantic Social Image Hover plugin for WordPress. The flaw exists in all versions up to and including 1.0.8. The root cause is missing nonce validation on the plugin's settings update functionality. Unauthenticated attackers can forge requests that update plugin settings and inject malicious web scripts, provided they trick a site administrator into clicking a crafted link. The vulnerability is tracked under CWE-352 and carries a medium severity rating.

Critical Impact
Successful exploitation allows unauthenticated attackers to modify plugin settings and inject persistent web scripts into WordPress sites through administrator interaction.

Affected Products

Quantic Social Image Hover plugin for WordPress
All versions up to and including 1.0.8
WordPress sites with the tw-image-hover-share plugin installed and active

Discovery Timeline

2025-12-05 - CVE-2025-13360 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13360

Vulnerability Analysis

The Quantic Social Image Hover plugin exposes a settings update handler that does not validate a WordPress nonce token before processing incoming requests. WordPress nonces are the framework's standard mechanism for verifying that a state-changing request originated from an authenticated user session rather than a third-party site. Without this check, the plugin trusts any request that reaches the endpoint with valid administrator cookies, regardless of origin.

An attacker can craft a malicious HTML page or link containing a forged POST request targeting the vulnerable endpoint. When a logged-in administrator visits the attacker-controlled resource, the browser automatically attaches the administrator's authentication cookies to the outbound request. The plugin then processes the forged payload as if it were a legitimate administrative action.

Because the settings fields accept text that is later rendered in the site's frontend, attackers can inject JavaScript payloads through the same forged request. This extends the impact from configuration tampering to stored script injection affecting site visitors.

Root Cause

The vulnerability stems from the absence of wp_verify_nonce() or check_admin_referer() calls in the settings update code path within tw-image-hover.php. The plugin also fails to sanitize input before persisting it, which enables the script injection component of the attack.

Attack Vector

Exploitation requires user interaction. The attacker delivers a link, email, or web page containing an auto-submitting form or JavaScript that issues a request to the vulnerable WordPress admin endpoint. Delivery typically occurs through phishing, forum posts, or comment fields on sites the target administrator visits. No credentials are required by the attacker because the request executes in the administrator's authenticated session.

See the Wordfence Vulnerability Intelligence advisory and the plugin source at line 103 for the specific handler lacking nonce checks.

Detection Methods for CVE-2025-13360

Indicators of Compromise

Unexpected modifications to Quantic Social Image Hover plugin settings without a corresponding administrator action in audit logs
Presence of <script> tags or JavaScript payloads within stored plugin configuration values
HTTP POST requests to the plugin's settings endpoint with a Referer header pointing to an external domain
Frontend pages rendering unexpected inline scripts sourced from plugin output

Detection Strategies

Review WordPress database entries associated with the tw-image-hover-share plugin for unsanitized HTML or script content
Inspect web server access logs for POST requests to the plugin's admin handler originating from unusual referrers or without a valid nonce parameter
Monitor for administrator sessions issuing settings updates immediately after visiting external links

Monitoring Recommendations

Enable WordPress audit logging to capture plugin configuration changes with timestamps and user attribution
Deploy a web application firewall (WAF) with rules that flag cross-origin POST requests to /wp-admin/ endpoints
Alert on frontend page responses that contain script tags not present in prior baselines

How to Mitigate CVE-2025-13360

Immediate Actions Required

Deactivate the Quantic Social Image Hover plugin until a patched version is confirmed installed
Audit current plugin settings for injected scripts or unauthorized configuration values and restore known-good values
Instruct administrators to log out of WordPress sessions before browsing untrusted content

Patch Information

At the time of publication, no fixed version had been referenced in the NVD entry. Site operators should monitor the WordPress plugin repository for a release beyond 1.0.8 that introduces nonce validation on the settings update handler, and apply it as soon as it becomes available. Consult the Wordfence advisory for updated patch status.

Workarounds

Remove the plugin entirely if the image hover functionality is not business critical
Restrict administrator access to the WordPress dashboard using IP allowlisting at the web server or WAF layer
Require administrators to use a dedicated browser profile for WordPress administration to reduce the risk of CSRF via concurrent browsing
Apply a WAF rule that rejects POST requests to plugin admin endpoints when the Referer header is missing or off-origin

bash

# Example nginx rule to block off-origin POSTs to the vulnerable endpoint
location ~* /wp-admin/admin\.php {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-wordpress-domain\.com/") {
            return 403;
        }
    }
}