CVE-2025-13360: CSRF in Quantic Social Image Hover

The primary impact of this CSRF vulnerability lies in the ability of an attacker to manipulate the Quantic Social Image Hover plugin's configuration without authentication. By crafting a malicious request and tricking a site administrator into clicking a link or visiting a compromised page, an attacker can alter plugin settings. This could involve injecting arbitrary JavaScript code, redirecting users to phishing sites, or modifying the plugin’s behavior to serve malicious content. The blast radius extends to all users of the affected WordPress site, particularly administrators who are more likely to interact with plugin settings.

1. Reserved2025-11-18
2. Published2025-12-05
3. Modified2026-04-08
4. EPSS updated2026-03-23

The immediate mitigation for CVE-2025-13360 is to upgrade the Quantic Social Image Hover plugin to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds such as restricting access to plugin settings pages to authenticated administrators only. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can also provide a layer of protection. Regularly review plugin settings for any unauthorized changes. After upgrading, verify the plugin's settings have been restored to their intended configuration and that no malicious scripts have been injected.