Cross-Site Request Forgery Vulnerability in Quran Gateway Plugin for WordPress

CVE-2025-14164

What is CVE-2025-14164?

The Quran Gateway plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to a lack of nonce validation in the quran_gateway_options function. This vulnerability allows unauthenticated attackers to manipulate the plugin's display settings by crafting malicious requests. If an attacker can deceive a site administrator into clicking a specially crafted link, they could potentially alter site configurations without proper authorization. It is vital for administrators using this plugin to apply the necessary patches to ensure their site's security against such exploits.

References