Vulnerability · Published Jun 1, 2021 · Assigned by WPScan

CVE-2021-24313WP Prayer < 1.6.2 - Authenticated Stored Cross-Site Scripting (XSS)

Medium 5.4

In plain English

A medium-severity cross-site scripting in WP Prayer from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.7%top 46.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Prayer	1.6.2 – before 1.6.2

Weakness: CWE-79

References

https://wpscan.com/vulnerability/c7ab736d-27c4-4ec5-9681-a3f0dda86586 x_refsource_CONFIRM
https://bastijnouwendijk.com/cve-2021-24313/ x_refsource_MISC