CVE-2026-4074 is a stored cross-site scripting vulnerability in the Quran Live Multilanguage WordPress plugin (up to version 1.0.3). The issue arises from insufficient input sanitization and output escaping of the 'cheikh' and 'lang' shortcode attributes. These attributes are passed through shortcode_atts() and extract() without sanitization, then echoed directly inside inline <script> tags in Class_QuranLive.php. This allows an authenticated user with Contributor or higher privileges to inject arbitrary JavaScript code, which executes in the context of any user viewing the infected page.

An attacker with Contributor-level or higher access can inject malicious JavaScript code into pages using the vulnerable shortcode attributes. This script executes in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Quran Live Multilanguage plugin if possible. Monitor for plugin updates from the vendor addressing this vulnerability.