CVE-2026-8845 is a stored cross-site scripting vulnerability in the Islamic Database WordPress plugin by samiullah-kaifi. The flaw exists in the islamicDB_sc_quran_qari_roqya() function, which processes the 'islamicDB-roqya' shortcode. User-supplied 'width' and 'height' shortcode attributes are concatenated directly into iframe HTML attributes without sufficient input sanitization or output escaping. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to the execution of arbitrary JavaScript in the browsers of users who visit the affected pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface somewhat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Islamic Database plugin if feasible. Monitor for updates from the vendor or plugin repository for a security patch addressing this issue.