CVE-2026-4141

The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation in the quran_playlist_options() function that handles the plugin's settings page. The function processes POST requests to update plugin options via update_option() without any wp_nonce_field() in the form or wp_verify_nonce()/check_admin_referer() verification before processing. This makes it possible for unauthenticated attackers to modify plugin settings (toggling display options for PDF, RSS, podcast, media player links, playlist title, and playlist code) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/tags/1.7/playlist.php#L143
• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/tags/1.7/playlist.php#L167
• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/trunk/playlist.php#L143
• https://plugins.trac.wordpress.org/browser/quran-translations-by-edc/trunk/playlist.php#L167
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e30379bf-0ea1-4443-81bb-4337a0311ed3?source=cve

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41404OpenClaw before 2026.3.31 contains an incomplete scope-clear…8.8
• CVE-2026-41405OpenClaw before 2026.3.31 parses MS Teams webhook request bo…8.7
• CVE-2026-41406OpenClaw before 2026.3.31 contains a sender allowlist bypass…5.4
• CVE-2026-41407OpenClaw before 2026.4.2 contains a timing side channel vuln…5.3
• CVE-2026-41408OpenClaw before 2026.3.31 contains a resource exhaustion vul…6.5
• CVE-2026-41409The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.g…9.8
• CVE-2026-41410Rejected reason: REJECT ** DO NOT USE THIS CANDIDATE NUMBER.…
• CVE-2026-41411Vim is an open source, command line text editor. Prior to 9.…6.6
• CVE-2026-41412alf.io is an open source ticket reservation system for confe…4.9
• CVE-2026-41413Istio is an open platform to connect, manage, and secure mic…7.7
• CVE-2026-41414Skim is a fuzzy finder designed to through files, lines, and…7.4
• CVE-2026-41415PJSIP is a free and open source multimedia communication lib…9.1