Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

3 vulnerabilities by karim42

CVE-2026-4074 (GCVE-0-2026-4074)

Vulnerability from cvelistv5 – Published: 2026-04-22 07:45 – Updated: 2026-04-22 15:31
VLAI?
Title
Quran Live Multilanguage <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Summary
The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attributes in all versions up to, and including, 1.0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The quran_live_render() function of quran-live.php receives shortcode attributes and passes them directly through shortcode_atts() and extract() without any sanitization. These values are then passed to Render_Quran_Live::render_verse_quran_live() where they are echoed directly into inline <script> blocks using PHP short tags (<?=$cheikh;?> and <?=$lang;?>) at lines 191, 216, 217, 245, and 246 of Class_QuranLive.php. Since the output occurs inside a JavaScript context within <script> tags, an attacker can break out of the JavaScript string and inject arbitrary script code. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
karim42 Quran Live Multilanguage Affected: 0 , ≤ 1.0.3 (semver)
Create a notification for this product.
Credits
Gilang Asra Bilhadi
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4074",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T15:26:15.634329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T15:31:29.305Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Quran Live Multilanguage",
          "vendor": "karim42",
          "versions": [
            {
              "lessThanOrEqual": "1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gilang Asra Bilhadi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027cheikh\u0027 and \u0027lang\u0027 shortcode attributes in all versions up to, and including, 1.0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The quran_live_render() function of quran-live.php receives shortcode attributes and passes them directly through shortcode_atts() and extract() without any sanitization. These values are then passed to Render_Quran_Live::render_verse_quran_live() where they are echoed directly into inline \u003cscript\u003e blocks using PHP short tags (\u003c?=$cheikh;?\u003e and \u003c?=$lang;?\u003e) at lines 191, 216, 217, 245, and 246 of Class_QuranLive.php. Since the output occurs inside a JavaScript context within \u003cscript\u003e tags, an attacker can break out of the JavaScript string and inject arbitrary script code. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-22T07:45:39.289Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/883484dd-d48d-46f9-ae96-223626c50039?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/trunk/inc/Class_QuranLive.php#L191"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/tags/1.0.3/inc/Class_QuranLive.php#L191"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/trunk/inc/Class_QuranLive.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/tags/1.0.3/inc/Class_QuranLive.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/trunk/inc/Class_QuranLive.php#L246"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/tags/1.0.3/inc/Class_QuranLive.php#L246"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/trunk/inc/Class_QuranLive.php#L216"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/tags/1.0.3/inc/Class_QuranLive.php#L216"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/trunk/inc/Class_QuranLive.php#L245"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/tags/1.0.3/inc/Class_QuranLive.php#L245"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/trunk/quran-live.php#L110"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quran-live/tags/1.0.3/quran-live.php#L110"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-21T19:06:14.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Quran Live Multilanguage \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-4074",
    "datePublished": "2026-04-22T07:45:39.289Z",
    "dateReserved": "2026-03-12T19:52:43.714Z",
    "dateUpdated": "2026-04-22T15:31:29.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47524 (GCVE-0-2025-47524)

Vulnerability from cvelistv5 – Published: 2025-05-07 14:20 – Updated: 2026-04-01 15:53
VLAI?
Title
WordPress Quran multilanguage Text & Audio plugin <= 2.3.23 - Cross Site Scripting (XSS) Vulnerability
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karim42 Quran multilanguage Text & Audio quran-text-multilanguage allows Stored XSS.This issue affects Quran multilanguage Text & Audio: from n/a through <= 2.3.23.
Severity ?
No CVSS data available.
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
karim42 Quran multilanguage Text & Audio Affected: 0 , ≤ 2.3.23 (custom)
Create a notification for this product.
Date Public ?
2026-04-01 16:40
Credits
Nabil Irawan | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T17:20:44.825502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T18:18:57.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "quran-text-multilanguage",
          "product": "Quran multilanguage Text \u0026 Audio",
          "vendor": "karim42",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.3.24",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.3.23",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:40:06.128Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in karim42 Quran multilanguage Text \u0026 Audio quran-text-multilanguage allows Stored XSS.\u003cp\u003eThis issue affects Quran multilanguage Text \u0026 Audio: from n/a through \u003c= 2.3.23.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in karim42 Quran multilanguage Text \u0026 Audio quran-text-multilanguage allows Stored XSS.This issue affects Quran multilanguage Text \u0026 Audio: from n/a through \u003c= 2.3.23."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T15:53:28.110Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/quran-text-multilanguage/vulnerability/wordpress-quran-multilanguage-text-audio-2-3-23-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Quran multilanguage Text \u0026 Audio plugin \u003c= 2.3.23 - Cross Site Scripting (XSS) Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-47524",
    "datePublished": "2025-05-07T14:20:09.315Z",
    "dateReserved": "2025-05-07T09:39:40.223Z",
    "dateUpdated": "2026-04-01T15:53:28.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-11973 (GCVE-0-2024-11973)

Vulnerability from cvelistv5 – Published: 2024-12-10 09:24 – Updated: 2026-04-08 16:34
VLAI?
Title
Quran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters
Summary
The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' parameter in all versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity ?
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
karim42 Quran multilanguage Text & Audio Affected: 0 , ≤ 2.3.21 (semver)
Create a notification for this product.
Credits
vgo0
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11973",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-10T15:09:09.452078Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T15:09:18.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Quran multilanguage Text \u0026 Audio",
          "vendor": "karim42",
          "versions": [
            {
              "lessThanOrEqual": "2.3.21",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "vgo0"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Quran multilanguage Text \u0026 Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027sourate\u0027 and \u0027lang\u0027 parameter in all versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:34:31.883Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09afbbd2-52c6-48a6-a2f0-b1509d864e7e?source=cve"
        },
        {
          "url": "https://wordpress.org/plugins/quran-text-multilanguage/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3203456/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-12-09T21:09:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Quran multilanguage Text \u0026 Audio \u003c= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-11973",
    "datePublished": "2024-12-10T09:24:25.651Z",
    "dateReserved": "2024-11-28T22:07:22.631Z",
    "dateUpdated": "2026-04-08T16:34:31.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}