CVE-2021-24313

The WP Prayer WordPress plugin (before 1.6.2) contains an authenticated stored XSS vulnerability in the prayer/praise request form. The issue arises because the 'prayer request' and 'praise request' fields do not properly validate input, allowing an authenticated user to store XSS payloads that c...

CVE-2024-3406

CVE-2024-3406 affects WP Prayer WordPress plugin up to version 2.0.9 and older, lacking CSRF protection when updating email settings. This enables a logged-in admin to change settings via CSRF. CVSSv3.1 base score 8.8 (HIGH). Remediation noted across sources as updating to a version that adds a C...

CVE-2024-3405

The CVE-2024-3405 entry concerns the WordPress plugin WP Prayer, affected in versions 2.0.9 and earlier, with a CSRF flaw in the settings update workflow that could allow an authenticated attacker to trigger changes in a logged-in admin’s settings. The available connected docs confirm the issue a...

CVE-2024-3407

WP Prayer WordPress plugin versions 2.0.9 and earlier have CSRF protection gaps, allowing logged-in users to trigger unintended actions (e.g., arbitrary deletion) via CSRF. Patch/mitigation guidance in provided sources points to upgrading to a version that includes CSRF checks; no exact fixed ver...

CVE-2023-25705

CVE-2023-25705 describes an authenticated (admin+) stored cross-site scripting vulnerability in the WordPress plugin WP Prayer (Go Prayer, WP Prayer)

CVE-2021-4412

CVE-2021-4412 affects the WP Prayer plugin for WordPress (versions up to and including 1.6.5). The root cause is missing/incorrect nonce validation in the save() and export() functions, enabling CSRF. This allows unauthenticated attackers to change plugin settings and trigger a data export if a s...