CVE-2024-3406 WP Prayer <= 2.0.9 - Email Settings Update via CSRF

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3405 WP Prayer <= 2.0.9 - Settings Update via CSRF

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin WP Prayer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin WP Prayer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-25680 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer WordPress plugin versions 2.0.9 and earlier Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF attacks...

PT-2024-25667 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer WordPress plugin versions 2.0.9 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations:...

WordPress plugin WP Prayer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress WP Prayer Plugin <= 2.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Prayer Type Plugin Vulnerable versions = 2.0.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3405 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fe4f86d8e888 Credits Bob Matyas Required privileg...

PT-2024-25672

Name of the Vulnerable Software and Affected Versions WP Prayer WordPress plugin versions 2.0.9 and earlier Description The issue concerns a lack of CSRF check when updating email settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could potentially...

WP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks PoC Make and admin open a URL where is any valid prayer ID: https://example.com/wp-admin/admin.php?page=wpemanageprayer=deleteid=...

WP Prayer <= 2.0.9 - Email Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack Make a logged in admin open an HTML file containing:...

WP Prayer <= 2.0.9 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Make a logged in admin open a page containing: input type="hidden"...

WP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Make and admin open a URL where is any valid prayer ID: https://example.com/wp-admin/admin.php?page=wpemanageprayer&doaction=delete&prayer...

Daily Prayer Time < 2023.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Description The Daily Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2023.10.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-47817

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mmrs151 Daily Prayer Time plugin = 2023.10.13 versions...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mmrs151 Daily Prayer Time plugin = 2023.10.13 versions...

CVE-2023-47817 WordPress Daily Prayer Time Plugin <= 2023.10.13 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mmrs151 Daily Prayer Time plugin = 2023.10.13 versions...

CVE-2023-47817 WordPress Daily Prayer Time Plugin <= 2023.10.13 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mmrs151 Daily Prayer Time plugin = 2023.10.13 versions...

CVE-2023-47817

CVE-2023-47817 is a Cross-Site Scripting (XSS) vulnerability in the WordPress plugin mmrs151 Daily Prayer Time, affecting versions up to 2023.10.13. Public sources confirm improper neutralization of input during web page generation as the root cause. PatchStack documents a fixed release on 2023-1...

WordPress Plugin Daily Prayer Time Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...