CVE-2026-4074 is a stored cross-site scripting vulnerability in the Quran Live Multilanguage WordPress plugin, affecting all versions up to 1.0.3. The vulnerability is due to improper neutralization of input (CWE-79) in the 'cheikh' and 'lang' shortcode attributes. The plugin's quran_live_render() function passes these attributes without sanitization to Render_Quran_Live::render_verse_quran_live(), which outputs them directly inside inline <script> tags using PHP short tags. This allows an attacker with Contributor-level or higher privileges to inject arbitrary JavaScript code that executes whenever the page is viewed.

An attacker with Contributor-level or higher privileges can exploit this vulnerability to inject malicious JavaScript code into pages rendered by the plugin. This code executes in the context of users visiting the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Quran Live Multilanguage plugin if possible. Avoid using the vulnerable shortcode attributes or sanitize inputs manually if feasible. Monitor vendor channels for updates or patches addressing this issue.