CVE-2026-8845

Name of the Vulnerable Software and Affected Versions Islamic Database plugin for WordPress version 1.0

Description Stored Cross-Site Scripting occurs via the 'islamicDB-roqya' shortcode. The issue stems from insufficient input sanitization and output escaping of the width and height shortcode attributes within the islamicDB sc quran qari roqya() function, which are concatenated directly into HTML iframe attribute values. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.