What is the CVSS score of CVE-2026-8845?

CVE-2026-8845 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Islamic Database CVE-2026-8845

EUVD-2026-32081 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-89p9-6wwj-jr39

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:58 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB_sc_quran_qari_roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Islamic Database WordPress plugin (versions ≤ 1.0) allows authenticated contributors to persistently inject arbitrary JavaScript into WordPress pages via the 'islamicDB-roqya' shortcode's 'width' and 'height' attributes. The flaw originates in the islamicDB_sc_quran_qari_roqya() function, which concatenates these shortcode attribute values directly into HTML iframe attribute values without sanitization or output escaping. No public exploit has been identified and EPSS sits at 0.03% (9th percentile), reflecting low current exploitation probability, though the contributor-level access requirement is a realistic barrier given how many WordPress sites grant that role to content editors.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes this root cause class: user-controlled data is embedded in HTML output without sanitization or contextual escaping. Specifically, the islamicDB_sc_quran_qari_roqya() function in islamic_database.php (lines 561 and 567 per the NVD-linked Trac source) constructs an HTML iframe element and inserts the shortcode's 'width' and 'height' attribute values as raw strings into the iframe's corresponding HTML attributes. In WordPress plugin development, the correct mitigations are input sanitization via absint() or sanitize_text_field() at ingestion, and output escaping via esc_attr() at the point of HTML rendering. Neither appears to be applied here. The CVSS Scope:Changed (S:C) rating reflects XSS's characteristic scope-change: code injected in the plugin's context executes under the victim's browser session, potentially affecting resources outside the WordPress page itself.

RemediationAI

No vendor-released patched version has been identified at time of analysis; affected versions are all releases up to and including 1.0. Site administrators should deactivate and remove the Islamic Database plugin until a patched release is available from the plugin author. The Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/98c3762b-9dcd-4931-846e-3f54fe2bf5e2 should be monitored for patch availability updates. As a compensating control, restrict contributor-level account creation to fully trusted users only, and audit existing contributor accounts for unauthorized access. Wordfence firewall rules (free or premium) may provide virtual patching for this specific vulnerability on sites running that plugin. If the plugin cannot be removed and no patch exists, disabling use of the 'islamicDB-roqya' shortcode in page content is the most targeted workaround, though this disables the affected plugin feature entirely.