CVE-2026-8845: Islamic Database WordPress XSS Vulnerability

CVE-2026-8845 Overview

CVE-2026-8845 is a Stored Cross-Site Scripting (XSS) vulnerability in the Islamic Database plugin for WordPress, affecting versions up to and including 1.0. The flaw exists in the islamicDB_sc_quran_qari_roqya() function, which handles the islamicDB-roqya shortcode. The plugin fails to sanitize the width and height shortcode attributes before concatenating them into HTML iframe attribute values. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes whenever visitors load the affected page. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist arbitrary JavaScript into WordPress pages, enabling session theft, privilege escalation through admin-targeted payloads, and site defacement.

Affected Products

Islamic Database plugin for WordPress, versions up to and including 1.0
WordPress sites using the islamicDB-roqya shortcode
WordPress installations allowing contributor-level (or higher) accounts to publish content with shortcodes

Discovery Timeline

2026-05-27 - CVE-2026-8845 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8845

Vulnerability Analysis

The Islamic Database plugin registers the islamicDB-roqya shortcode, processed by islamicDB_sc_quran_qari_roqya(). This function accepts user-supplied width and height attributes and embeds them directly into an HTML iframe element rendered to the page. The plugin neither sanitizes inbound attribute values nor applies output escaping such as esc_attr() before emitting markup. Attackers control the raw string written into the iframe tag.

Because the attacker payload is stored in the post or page content where the shortcode is used, the script executes for every visitor who loads the page. The Stored XSS reach extends to administrators who preview or edit the page, enabling session hijacking, forced administrative actions via CSRF chaining, and persistent backdoors through plugin or user creation.

The attack requires contributor-level access. WordPress contributors can create draft posts containing shortcodes, lowering the privilege bar for exploitation in multi-author environments.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attribute values. WordPress provides esc_attr(), absint(), and sanitize_text_field() for these contexts. The plugin invokes none of them on the width and height parameters before string concatenation into the iframe tag, as referenced in the plugin source at lines 561 and 567. See the WordPress Plugin Code Reference (L561) and WordPress Plugin Code Reference (L567).

Attack Vector

An authenticated attacker with contributor or higher privileges creates a post containing the islamicDB-roqya shortcode with a crafted width or height attribute. The attribute breaks out of the iframe attribute context using a quote character and injects an event handler such as onload or onerror carrying JavaScript. When any user renders the post, the injected script executes in the visitor's browser within the site origin.

The vulnerability requires no user interaction beyond loading the page. For full technical details, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-8845

Indicators of Compromise

Post or page content containing the [islamicDB-roqya] shortcode with quote characters, angle brackets, or HTML event handlers inside the width or height attributes
Outbound requests from visitor browsers to attacker-controlled domains after loading pages with the plugin's shortcode
Unexpected administrator account creation or plugin installation following contributor publishing activity
Modified WordPress options, theme files, or new admin sessions originating from contributor-authored pages

Detection Strategies

Scan the wp_posts table for shortcode usage matching the pattern [islamicDB-roqya with attribute values containing ", <, javascript:, or on[a-z]+=
Review web server logs for requests to pages containing the shortcode and correlate with anomalous JavaScript execution or third-party script loads
Monitor WordPress audit logs for content edits by contributor accounts that introduce shortcodes with unusual attribute payloads

Monitoring Recommendations

Enable a Content Security Policy (CSP) with script-src restrictions and log CSP violation reports to surface injected scripts
Alert on creation or modification of administrator accounts within a short window after contributor post submissions
Track installations of the Islamic Database plugin across managed WordPress sites and inventory version 1.0 instances for prioritized response

How to Mitigate CVE-2026-8845

Immediate Actions Required

Deactivate and remove the Islamic Database plugin until a patched version is released
Audit all posts and pages containing the [islamicDB-roqya] shortcode and remove or sanitize entries with suspicious attribute values
Restrict contributor-level account creation and review existing contributor accounts for unauthorized activity
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for versions beyond 1.0. Monitor the Wordfence Vulnerability Report and the plugin repository for updates. Apply the patched release immediately when published and verify the fix by inspecting the islamicDB_sc_quran_qari_roqya() function for esc_attr() or equivalent escaping on the width and height attributes.

Workarounds

Remove the plugin entirely if the islamicDB-roqya shortcode is not required
Limit shortcode usage by restricting which roles can publish posts containing shortcodes through a role-management plugin
Deploy a Web Application Firewall (WAF) rule blocking requests that submit post content containing [islamicDB-roqya with quote characters or event handler patterns in attributes
Enforce a strict Content Security Policy that disallows inline scripts and limits permitted script sources

bash

# Configuration example: locate and disable the vulnerable plugin via WP-CLI
wp plugin deactivate islamic-database
wp plugin delete islamic-database

# Audit posts for the vulnerable shortcode
wp db query "SELECT ID, post_title, post_status FROM wp_posts WHERE post_content LIKE '%[islamicDB-roqya%';"