WordPress Daily Prayer Time plugin <= 2021.10.29 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Daily Prayer Time plugin versions = 2021.10.29. Solution Update the WordPress Daily Prayer Time plugin to the latest available version at least 2022.03.01...

Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi

The plugin does not sanitise and escape the month parameter before using it in a SQL statement via the getmonthlytimetable AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection PoC curl 'https://example.com/wp-admin/admin-ajax.php' --data...

Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi

The plugin does not sanitise and escape the month parameter before using it in a SQL statement via the getmonthlytimetable AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection curl 'https://example.com/wp-admin/admin-ajax.php' --data...

CVE-2021-24523

The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues...

CVE-2021-24523

The CVE-2021-24523 entry refers to the WordPress plugin Daily Prayer Time (versions prior to 2021.08.10), where an Authenticated Stored Cross-Site Scripting (XSS) vulnerability exists because the plugin does not sanitise or escape some settings before output. The issue affects output in plugin pa...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Daily Prayer Time, which stems...

PT-2021-16045 · WordPress · Daily Prayer Time

Name of the Vulnerable Software and Affected Versions: The Daily Prayer Time WordPress plugin versions prior to 2021.08.10 Description: The issue is related to Authenticated Stored Cross-Site Scripting. It occurs because the plugin does not properly sanitise or escape some of its settings before...

WordPress Daily Prayer Time plugin <= 2021.08.07 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Daily Prayer Time plugin versions = 2021.08.07. Solution Update the WordPress Daily Prayer Time plugin to the latest available version at least 2021.08.10...

Daily Prayer Time < 2021.08.10 - Authenticated Stored XSS

The plugin does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues. Put the following payload in the Fajr, Sunrise, Zuhr, Asr, Maghrib and/or Isha field of the Language settings of the plugin...