CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
19.8%
# Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2021-05-31
# Exploit Author: Bastijn Ouwendijk
# Vendor Homepage: http://goprayer.com/
# Software Link: https://wordpress.org/plugins/wp-prayer/
# Version: 1.6.1 and earlier
# Tested on: Windows 10
# Proof: https://bastijnouwendijk.com/cve-2021-24313/
Steps to exploit this vulnerability:
1. Log into the WordPress website with a user account, can be a user with any role
2. Go to the page where prayer or praise request can be made and fill in the requested information
3. In the 'prayer_messages' field of the prayer request form put the payload: <script>alert("XSS")</script>
4. Submit the form
5. Go to the page where the prayer requests are listed
6. The prayer requests are loaded and an alert is shown with text 'XSS' in the browser
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
19.8%