CVE-2025-13527 is a CSRF vulnerability in the xShare WordPress plugin by anwerashif affecting all versions up to 1.0.1. The issue arises because the xshare_plugin_reset() function lacks nonce validation, enabling unauthenticated attackers to reset plugin settings if they can induce an administrator to perform an action such as clicking a crafted link. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and no required privileges but requiring user interaction. There is no vendor-provided patch or advisory available at this time.

An attacker can cause a site administrator to unknowingly reset the xShare plugin settings by exploiting the CSRF vulnerability. This could lead to loss of customized plugin configurations, potentially disrupting site functionality or security settings managed by the plugin. There is no direct confidentiality, integrity, or availability impact beyond the resetting of plugin settings as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections at the WordPress or server level may help mitigate risk.