CVE-2025-13360 describes a CSRF vulnerability in the Quantic Social Image Hover plugin for WordPress, affecting all versions up to 1.0.8. The root cause is the absence of nonce validation on the settings update endpoint, enabling attackers to forge requests that an authenticated administrator might unknowingly execute. This can lead to unauthorized modification of plugin settings and potential injection of malicious web scripts. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and has a network attack vector (AV:N).

An attacker can exploit this vulnerability by tricking a site administrator into clicking a crafted link, causing unauthorized changes to plugin settings and possible injection of malicious scripts. This could lead to limited integrity impact on the affected site. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links and consider disabling or removing the plugin if possible. Monitoring for updates from the vendor or security advisories is recommended.