CVE-2025-13621 is a CSRF vulnerability in the WordPress dream gallery plugin (versions up to 1.0). The issue arises from improper or missing nonce validation on the 'dreampluginsmain' AJAX action, enabling attackers to forge requests that can update plugin settings and inject malicious web scripts if an administrator is tricked into executing the action. The vulnerability requires user interaction (UI:R) and has network attack vector (AV:N) with no privileges required (PR:N).

An attacker can exploit this vulnerability to modify plugin settings and inject malicious scripts by tricking an administrator into performing an action, potentially leading to partial confidentiality and integrity loss. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution with unsolicited links and consider limiting administrative access or implementing additional CSRF protections at the site level.