What is the CVSS score of CVE-2026-4074?

CVE-2026-4074 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Quran Live Multilanguage CVE-2026-4074

EUVD-2026-24644 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-59pf-538p-vw7w

XSS WordPress PHP

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:02 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24644

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attributes in all versions up to, and including, 1.0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The quran_live_render() function of quran-live.php receives shortcode attributes and passes them directly through shortcode_atts() and extract() without any sanitization. These values are then passed to Render_Quran_Live::render_verse_quran_live() where they are echoed directly into inline <script> blocks using PHP short tags (<?=$cheikh;?> and <?=$lang;?>) at lines 191, 216, 217, 245, and 246 of Class_QuranLive.php. Since the output occurs inside a JavaScript context within <script> tags, an attacker can break out of the JavaScript string and inject arbitrary script code. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Quran Live Multilanguage WordPress plugin versions up to 1.0.3 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via unsanitized shortcode attributes ('cheikh' and 'lang'). The vulnerability exploits insufficient input validation in the quran_live_render() function and direct output of user-supplied values into inline <script> blocks without escaping, enabling injection of arbitrary web scripts that execute whenever a user accesses the compromised page.

Technical ContextAI

The vulnerability exists in the quran-live.php and Class_QuranLive.php files of the Quran Live Multilanguage plugin (CPE: cpe:2.3:a:karim42:quran_live_multilanguage). The quran_live_render() function receives shortcode attributes and processes them through shortcode_atts() and PHP's extract() function without sanitization. The resulting variables are then passed to Render_Quran_Live::render_verse_quran_live() where they are echoed directly into JavaScript contexts using PHP short tags (<?=$cheikh;?> and <?=$lang;?>) at multiple locations (lines 191, 216, 217, 245, 246 of Class_QuranLive.php). Since these values appear within <script> tag boundaries, an attacker can break out of the intended JavaScript string context and inject arbitrary script code. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) scenario where output escaping is absent in a high-risk context (JavaScript within HTML).

RemediationAI

Update the Quran Live Multilanguage plugin to a patched version released after 1.0.3 (exact patched version number not provided in available advisory data; consult the plugin's WordPress.org page for the latest release). The remediation requires properly sanitizing shortcode attributes using WordPress sanitization functions (e.g., sanitize_text_field(), wp_kses_post()) upon receipt from shortcode_atts() and extract(), and escaping output contextually using wp_json_encode() or json_encode() when inserting values into JavaScript contexts, rather than bare PHP short tags. For immediate mitigation on unpatched sites, restrict Contributor-level user account creation and audit existing Contributors to verify legitimacy; however, this is a compensating control with significant usability impact for legitimate editorial teams. The plugin repository link (https://plugins.trac.wordpress.org/browser/quran-live/) provides access to view patched code once released. Until a fix is available, consider disabling the plugin entirely if Contributor access cannot be strictly controlled.