Quantic Social Image Hover <= 1.0.8 - 跨站请求伪造可更新设置

The primary impact of this CSRF vulnerability lies in the ability of an attacker to manipulate the Quantic Social Image Hover plugin's configuration without authentication. By crafting a malicious request and tricking a site administrator into clicking a link or visiting a compromised page, an attacker can alter plugin settings. This could involve injecting arbitrary JavaScript code, redirecting users to phishing sites, or modifying the plugin’s behavior to serve malicious content. The blast radius extends to all users of the affected WordPress site, particularly administrators who are more likely to interact with plugin settings.

WordPress websites utilizing the Quantic Social Image Hover plugin, particularly those with administrative access granted to multiple users or those lacking robust security practices, are at risk. Shared hosting environments where plugin updates are managed centrally may also be vulnerable if the plugin is not promptly updated across all sites.

• wordpress / composer / npm:

grep -r 'social_image_hover_settings_update' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=all | grep Quantic Social Image Hover

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=social_image_hover_settings_update | grep -i '200 ok'

1. 2025-12-05Disclosure

   disclosure

1. 已保留2025-11-18
2. 发布日期2025-12-05
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The immediate mitigation for CVE-2025-13360 is to upgrade the Quantic Social Image Hover plugin to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds such as restricting access to plugin settings pages to authenticated administrators only. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can also provide a layer of protection. Regularly review plugin settings for any unauthorized changes. After upgrading, verify the plugin's settings have been restored to their intended configuration and that no malicious scripts have been injected.