CVE-2025-13365 is a Cross-Site Request Forgery vulnerability in the WP Hallo Welt plugin for WordPress, affecting all versions up to and including 1.4. The issue arises from missing or incorrect nonce validation on the 'hallo_welt_seite' function, enabling attackers to forge requests that update plugin settings and inject malicious web scripts if a site administrator is tricked into executing the action. The vulnerability is compounded by insufficient input sanitization and output escaping, which can result in Stored Cross-Site Scripting. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability by tricking a site administrator into performing an action that updates plugin settings and injects malicious scripts, potentially leading to Stored Cross-Site Scripting. This can compromise the integrity and confidentiality of the affected WordPress site. There is no indication of availability impact or known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should exercise caution with plugin usage and avoid clicking on suspicious links that could trigger forged requests. Monitoring vendor channels for updates is recommended.