Cross-Site Request Forgery Vulnerability in Dream Gallery Plugin for WordPress

CVE-2025-13621

What is CVE-2025-13621?

The Dream Gallery plugin for WordPress contains a cross-site request forgery vulnerability impacting all versions up to and including 1.0. This issue arises from inadequate nonce validation on the 'dreampluginsmain' AJAX action, allowing unauthenticated attackers to manipulate plugin settings. By deceiving a site administrator into clicking a specially crafted link, attackers can exploit this flaw to inject malicious scripts into the web application, potentially compromising the integrity of the site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References