edckwt vulnerabilities and threats

CVE-2026-4141 is a Cross-Site Request Forgery (CSRF) vulnerability in the Quran Translations WordPress plugin up to version 1.7. The vulnerability arises from missing nonce validation in the function that handles the plugin's settings page, allowing unauthenticated attackers to modify plugin settings by tricking an administrator into performing an action such as clicking a malicious link. This can lead to unauthorized changes to display options like PDF, RSS, podcast, media player links, playlist title, and playlist code. The vulnerability has a medium severity rating with a CVSS score of 4.3.

The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation in the quran_gateway_options function. This makes it possible for unauthenticated attackers to modify the plugin's display settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in edckwt Quran Shortcode quran-shortcode allows Blind SQL Injection.This issue affects Quran Shortcode: from n/a through <= 1.5.