CVE-2025-13621

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13621", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-24T20:43:27.215Z", "datePublished": "2025-12-05T05:31:22.608Z", "dateUpdated": "2026-04-08T16:47:35.707Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:35.707Z"}, "affected": [{"vendor": "teamdream", "product": "dream gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3cdf6ba0-2866-4347-8518-bb1d2e40bab3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/dreamgallery.php#L254"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/dreamgallery.php#L257"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/templates/front.php#L38"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/trunk/dreamgallery.php#L254"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-12-04T17:28:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T15:10:15.232614Z", "id": "CVE-2025-13621", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T20:09:04.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13621", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T15:10:15.232614Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T15:10:19.520Z"}}], "cna": {"title": "dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "teamdream", "product": "dream gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T17:28:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3cdf6ba0-2866-4347-8518-bb1d2e40bab3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/dreamgallery.php#L254"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/dreamgallery.php#L257"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/templates/front.php#L38"}, {"url": "https://plugins.trac.wordpress.org/browser/dream-gallery/trunk/dreamgallery.php#L254"}], "descriptions": [{"lang": "en", "value": "The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:35.707Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13621", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:35.707Z", "dateReserved": "2025-11-24T20:43:27.215Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T05:31:22.608Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "dream gallery", "vendor": "teamdream", "versions": [{"lessThanOrEqual": "1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin dream gallery para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 1.0, inclusive. Esto se debe a la validaci\u00f3n nonce faltante o incorrecta en la acci\u00f3n AJAX 'dreampluginsmain'. Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n del plugin e inyecten scripts web maliciosos a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13621", "lastModified": "2026-10-18T15:10:00.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13621", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T15:10:15.232614Z", "version": "2.0.3"}}]}, "published": "2025-12-05T06:16:08.063", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/dreamgallery.php#L254"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/dreamgallery.php#L257"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dream-gallery/tags/1.0/templates/front.php#L38"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dream-gallery/trunk/dreamgallery.php#L254"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3cdf6ba0-2866-4347-8518-bb1d2e40bab3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:46:30.080773+00:00", "value": {"mitigation_remediation": ["Update the Dream Gallery plugin to a patched version once it is released, or install a version newer than 1.0.", "If a fix is not yet available, immediately disable or uninstall the Dream Gallery plugin until an official update is issued.", "Apply a custom nonce check or restrict the \"dreampluginsmain\" AJAX endpoint to authenticated users only by modifying the plugin\u2019s code.", "Review the site for any unauthorized changes and audit administrator activity logs for suspicious entries."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Request Forgery leading to Stored XSS"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Dream Gallery plugin version 1.0 or earlier. The issue is tied to the plugin itself, not the core WordPress installation. Administrators of sites deploying these plugin versions are at risk.", "description_and_impact": "The Dream Gallery plugin for WordPress contains a Cross\u2011Site Request Forgery flaw in its \"dreampluginsmain\" AJAX endpoint. The flaw arises from missing or incorrect nonce checks, enabling an unauthenticated attacker to force an administrator to submit forged requests. This can change plugin settings and inject malicious scripts that are then stored and executed on the site, resulting in classic stored Cross\u2011Site Scripting. The vulnerability is classified as CWE\u2011352.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% shows that the likelihood of exploitation is low at present, and the vulnerability is not listed in CISA KEV. Exploitation requires a user interaction from a site administrator who is lured into clicking a malicious link or otherwise triggering the forged AJAX request. If such a click occurs, the attacker can gain persistent script execution under the administrator\u2019s privileges, which can lead to defacement, credential theft, or further compromise of the site."}}}}, "created": "2025-12-05T10:51:44.865995+00:00", "updated": "2026-04-21T18:00:11.701423+00:00", "vendors": ["teamdream", "teamdream$PRODUCT$dream_gallery", "wordpress", "wordpress$PRODUCT$wordpress"]}