Cross‑Site Request Forgery on the Quantic Social Image Hover WordPress plugin allows attackers who can trick an administrator into clicking a crafted link to change the plugin's settings without authentication. Because the settings update lacks nonce validation, an adversary can inject malicious scripts that will then be served to visitors as part of the site. This flaw can lead to client‑side code execution or other XSS‑style issues depending on the injected content. The weakness is classified as CWE‑352, highlighting the missing verification of request authenticity.

The vulnerable component is the Quantic Social Image Hover plugin (monkeyboz:Quantic Social Image Hover) released by monkeyboz. All versions up to and including 1.0.8 are affected. The plugin is commonly installed on WordPress sites to provide image hover sharing capabilities, and any site running these versions is at risk.

The CVSS base score of 4.3 indicates a low severity, and the EPSS score of less than 1 % shows that documented exploitation is unlikely at present. Nonetheless, the issue is not listed in CISA’s KEV catalog, meaning there are no known widespread exploits, but the attack requires only social engineering to persuade an administrator to click a forged link. Once successful, the attacker can alter configuration and embed malicious code, which could impact site integrity and compromise visitors.