Quran Translations
Monthly
Cross-Site Request Forgery (CSRF) in the Quran Translations WordPress plugin versions up to 1.7 allows unauthenticated attackers to modify plugin settings by tricking site administrators into clicking a malicious link. The vulnerability stems from missing nonce validation in the quran_playlist_options() function, which processes POST requests to update options like PDF, RSS, podcast, and media player display settings without cryptographic request verification. No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery (CSRF) in the Quran Translations WordPress plugin versions up to 1.7 allows unauthenticated attackers to modify plugin settings by tricking site administrators into clicking a malicious link. The vulnerability stems from missing nonce validation in the quran_playlist_options() function, which processes POST requests to update options like PDF, RSS, podcast, and media player display settings without cryptographic request verification. No public exploit code or active exploitation has been identified at time of analysis.