The Islamic Database plugin for WordPress contains a stored XSS flaw that originates from insufficient input sanitization and output escaping of the 'width' and 'height' attributes supplied to the islamicDB-roqya shortcode. These values are concatenated directly into an iframe element’s attributes, allowing an authenticated attacker with contributor or higher privileges to embed arbitrary JavaScript. When a site visitor loads a page that contains the malicious shortcode, the injected script runs in their browser, giving the attacker the ability to steal credentials, hijack sessions, or deface the site. The impact is limited to the users who view the compromised content but can be significant if the injected script accesses sensitive information or facilitates further attacks.

WordPress sites that have the Islamic Database plugin up to and including version 1.0 installed. Any user with contributor level access or higher who can insert or edit posts using the islamicDB-roqya shortcode is capable of exploiting the vulnerability.

The CVSS score of 6.4 reflects a moderate severity due to the requirement of legitimate contributor privileges and the need to inject the payload via the shortcode. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating that no publicly known exploits are currently documented. Nonetheless, the conditions for exploitation are straightforward: acquire contributor access and place malicious attributes in a post. Once the payload is stored in the site’s database, any visitor to pages containing the shortcode will be affected, enabling widespread cross‑site scripting attacks.