CVE-2021-24313

The WP Prayer WordPress plugin (before 1.6.2) contains an authenticated stored XSS vulnerability in the prayer/praise request form. The issue arises because the 'prayer request' and 'praise request' fields do not properly validate input, allowing an authenticated user to store XSS payloads that c...

CVE-2024-3406

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVE-2024-3405

The WP Prayer WordPress plugin (versions 2.0.9 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is the lack of CSRF checks when updating plugin settings, which could allow an attacker to trick a logged-in administrator into making unauthorized changes. Whi...

CVE-2023-25705

CVE-2023-25705 describes an authenticated (admin+) stored cross-site scripting vulnerability in the WordPress plugin WP Prayer (Go Prayer, WP Prayer)

CVE-2024-3407

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVE-2021-4412

CVE-2021-4412 affects the WP Prayer plugin for WordPress (versions up to and including 1.6.5). The root cause is missing/incorrect nonce validation in the save() and export() functions, enabling CSRF. This allows unauthenticated attackers to change plugin settings and trigger a data export if a s...