WordPress plugin Daily Prayer Time SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin. WordPress Daily Prayer Time...

Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi

The plugin does not sanitise and escape the month parameter before using it in a SQL statement via the getmonthlytimetable AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection PoC curl 'https://example.com/wp-admin/admin-ajax.php' --data...

WordPress Daily Prayer Time plugin <= 2021.10.29 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Daily Prayer Time plugin versions = 2021.10.29. Solution Update the WordPress Daily Prayer Time plugin to the latest available version at least 2022.03.01...

Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi

The plugin does not sanitise and escape the month parameter before using it in a SQL statement via the getmonthlytimetable AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection curl 'https://example.com/wp-admin/admin-ajax.php' --data...

WordPress Easy Prayer plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Prayer plugin versions = 1.2. Solution No patched version available...

WordPress Easy Prayer plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Prayer plugin versions = 1.2. Solution No patched version available...

CVE-2021-24523

The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues...

CVE-2021-24523

The CVE-2021-24523 entry refers to the WordPress plugin Daily Prayer Time (versions prior to 2021.08.10), where an Authenticated Stored Cross-Site Scripting (XSS) vulnerability exists because the plugin does not sanitise or escape some settings before output. The issue affects output in plugin pa...

PT-2021-16045 · WordPress · Daily Prayer Time

Name of the Vulnerable Software and Affected Versions: The Daily Prayer Time WordPress plugin versions prior to 2021.08.10 Description: The issue is related to Authenticated Stored Cross-Site Scripting. It occurs because the plugin does not properly sanitise or escape some of its settings before...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Daily Prayer Time, which stems...

Daily Prayer Time < 2021.08.10 - Authenticated Stored XSS

The plugin does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues. Put the following payload in the Fajr, Sunrise, Zuhr, Asr, Maghrib and/or Isha field of the Language settings of the plugin...

WordPress Daily Prayer Time plugin <= 2021.08.07 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Daily Prayer Time plugin versions = 2021.08.07. Solution Update the WordPress Daily Prayer Time plugin to the latest available version at least 2021.08.10...

WP Prayer < 1.5.5 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its wpeajaxcall AJAX action, which then call other method dynamically, allowing attacker to make user perform unwanted actions...

WordPress WP Prayer plugin <= 1.6.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by NinTechNet in the WordPress WP Prayer plugin versions = 1.6.5. Solution Update the WordPress WP Prayer plugin to the latest available version at least 1.6.6...

WP Prayer < 1.6.7 - Arbitrary Plugin Settings Update via CSRF

The plugin did not properly check for CSRF in some of its module functions, allowing attacker to make logged in admin change all plugin's settings including the email settings for example. v1.6.6 fixed most of CSRF checks, but the one in model.emailsettings.php was improperly fixed bypass still...

WordPress WP Prayer plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WP Prayer WordPress is an application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress...

CVE-2021-24313

The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to...

Input validation

The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to...

CVE-2021-24313

The WP Prayer WordPress plugin (before 1.6.2) contains an authenticated stored XSS vulnerability in the prayer/praise request form. The issue arises because the 'prayer request' and 'praise request' fields do not properly validate input, allowing an authenticated user to store XSS payloads that c...

WordPress WP Prayer 1.6.1 Cross Site Scripting

Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayermessages' Stored Cross-Site Scripting XSS Authenticated Date: 2021-05-31 Exploit Author: Bastijn Ouwendijk Vendor Homepage: http://goprayer.com/ Software Link: https://wordpress.org/plugins/wp-prayer/ Version: 1.6.1 and earlier Test...