Stored Cross-Site Scripting Vulnerability in Quran Live Multilanguage Plugin by WordPress

CVE-2026-4074

What is CVE-2026-4074?

The Quran Live Multilanguage plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping on user-supplied shortcode attributes. The plugin's quran_live_render() function processes shortcode parameters directly without proper checks, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript code into web pages. This malicious script executes whenever users visit the affected pages, potentially compromising user data and site integrity.

References