CVE-2026-8845 in Islamic Database Plugin
Summary
by MITRE • 05/27/2026
The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB_sc_quran_qari_roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/29/2026
The Islamic Database plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects versions up to and including 1.0. This weakness resides within the plugin's shortcode handling mechanism, specifically in the islamicDB_sc_quran_qari_roqya() function where user-supplied parameters are inadequately validated and escaped. The vulnerability stems from the plugin's failure to properly sanitize input data before incorporating it into HTML output, creating an attack vector that can be exploited by authenticated users with contributor-level privileges or higher. The affected shortcode attributes include 'width' and 'height' parameters that are directly concatenated into iframe HTML attribute values without proper sanitization measures.
The technical flaw manifests when an attacker with sufficient privileges submits malicious input through the 'width' and 'height' attributes of the 'islamicDB-roqya' shortcode. These parameters are processed without adequate validation or escaping, allowing malicious scripts to be embedded directly into the HTML output. The vulnerability is classified as a stored XSS issue because the malicious code is persisted in the database and executed whenever any user accesses a page containing the compromised shortcode. This type of vulnerability falls under CWE-79 - Improper Neutralization of Input During Web Page Generation, which specifically addresses the failure to properly escape or sanitize user-supplied data before including it in web page content.
The operational impact of this vulnerability is significant as it provides attackers with the ability to execute arbitrary JavaScript code within the context of any user's browser who accesses pages containing the compromised shortcode. This can lead to various malicious activities including session hijacking, credential theft, redirection to malicious websites, data exfiltration, and potential privilege escalation within the WordPress environment. The attack requires only contributor-level access, making it particularly dangerous as it can be exploited by users who are not necessarily administrators but still have the ability to modify content. The vulnerability affects all users who view pages containing the compromised shortcode, regardless of their privilege level, creating a broad attack surface.
Security mitigations for this vulnerability should focus on implementing proper input validation and output escaping mechanisms within the plugin's shortcode processing functions. The recommended approach involves sanitizing all user-supplied attributes using WordPress's built-in sanitization functions such as esc_attr() and esc_url() before incorporating them into HTML output. Additionally, the plugin should enforce strict validation of numeric values for width and height parameters to prevent injection of malicious code. This vulnerability aligns with ATT&CK technique T1566.001 - Phishing: Targeted Email, as attackers could potentially use this vulnerability to deliver malicious payloads through compromised content. Organizations should immediately update to patched versions of the plugin or implement temporary workarounds such as restricting contributor-level access to shortcode functionality. The remediation process should also include thorough code review to identify similar patterns of insufficient input sanitization in other plugin components, following the principle of least privilege and defensive programming practices.