Stored Cross-Site Scripting in Islamic Database Plugin for WordPress

CVE-2026-8845

What is CVE-2026-8845?

The Islamic Database plugin for WordPress contains a vulnerability that allows stored cross-site scripting through insufficient input sanitization. Specifically, in versions up to and including 1.0, authenticated users with contributor-level access can exploit the 'islamicDB-roqya' shortcode. This is achieved via 'width' and 'height' attributes that are improperly sanitized. As a result, attackers can inject malicious web scripts which execute whenever a user accesses the affected pages, posing significant security risks.

References