CVE-2026-8845

MEDIUM 6.4

Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

0th

The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB_sc_quran_qari_roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE	CWE-79
Vendor	samiullah-kaifi
Product	islamic database
Published	May 27, 2026
Last Updated	May 27, 2026

Stay Ahead of the Next One

Get instant alerts for samiullah-kaifi islamic database

Be the first to know when new medium vulnerabilities affecting samiullah-kaifi islamic database are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

samiullah-kaifi / Islamic Database

0 ≤ 1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/98c3762b-9dcd-4931-846e-3f54fe2bf5e2?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/islamic-database/trunk/islamic_database.php#L567 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/islamic-database/trunk/islamic_database.php#L561

Credits

nail majdeddine