PT-2026-34278 · Karim42 · Quran Live Multilanguage

Published

2026-04-22

·

Updated

2026-04-22

·

CVE-2026-4074

CVSS v3.1

6.4

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attributes in all versions up to, and including, 1.0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The quran live render() function of quran-live.php receives shortcode attributes and passes them directly through shortcode atts() and extract() without any sanitization. These values are then passed to Render Quran Live::render verse quran live() where they are echoed directly into inline

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4074

Affected Products

Quran Live Multilanguage