Pray For Me <= 1.0.4 - Unauthenticated Stored XSS

2024-05-2400:00:00

Bob Matyas

pray for me

unauthenticated

stored xss

plugin configuration

name fields

malicious script

exploit

admin view

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin

1. Configure the plugin to add the first name and last name fields to the form: https://example.com/wp-admin/admin.php?page=caruso_prayer_plugin_settings
2. Add the `[prayer_form]` shortcode to a post or page
3. As a unauthenticated user, fill out the form and enter `"><script>alert(1)</script>` in the "first name" and "last name" fields
4. As an admin, go to: https://example.com/wp-admin/admin.php?page=caruso_prayer_plugin to see the XSS