diff --git a/lib/reference-db.sh b/lib/reference-db.sh
index b7fb3e5..430395c 100755
--- a/lib/reference-db.sh
+++ b/lib/reference-db.sh
@@ -557,6 +557,37 @@ export -f db_get_all_users
 export -f db_get_user_databases
 export -f db_get_user_domains
 export -f db_get_database_owner
+#############################################################################
+# SIMPLE KEY-VALUE STORE (for cross-module session data)
+#############################################################################
+
+# Store a key-value pair in the reference database
+store_reference() {
+    local key="$1"
+    local value="$2"
+
+    if [ -z "$key" ] || [ -z "$value" ]; then
+        return 1
+    fi
+
+    # Use REF prefix for simple key-value pairs
+    echo "REF|$key|$value" >> "$SYSREF_DB"
+}
+
+# Retrieve the most recent value for a key
+get_reference() {
+    local key="$1"
+
+    if [ -z "$key" ] || [ ! -f "$SYSREF_DB" ]; then
+        return 1
+    fi
+
+    # Get the most recent value (last occurrence)
+    grep "^REF|$key|" "$SYSREF_DB" 2>/dev/null | tail -1 | cut -d'|' -f3
+}
+
+export -f store_reference
+export -f get_reference
 export -f db_get_all_wordpress
 export -f db_get_system_info
 export -f db_get_health_metric
diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index a481330..29085ae 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -12,6 +12,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 source "$SCRIPT_DIR/lib/common-functions.sh" 2>/dev/null || true
 source "$SCRIPT_DIR/lib/system-detect.sh" 2>/dev/null || true
 source "$SCRIPT_DIR/lib/user-manager.sh" 2>/dev/null || true
+source "$SCRIPT_DIR/lib/reference-db.sh" 2>/dev/null || true
 
 # Arrays for docroots and scanners
 declare -a docroot_array