Quantic Social Image Hover WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Quantic Social Image Hover plugin for WordPress, affecting all versions through 1.0.8. The vulnerability arises from a lack of nonce validation in the settings update process, allowing unauthenticated attackers to manipulate the plugin's settings and inject malicious scripts. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the plugin's settings, including the injection of malicious web scripts.