Advertisement






WordPress WP Prayer 1.6.1 Cross Site Scripting

CVE Category Price Severity
CVE-2021-24313 CWE-79 $500 High
Author Risk Exploitation Type Date
Unknown High Remote 2021-06-01
CPE
cpe:cpe:/a:wordpress:wp_prayer:1.6.1
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021060001

Below is a copy:

WordPress WP Prayer 1.6.1 Cross Site Scripting
# Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2021-05-31
# Exploit Author: Bastijn Ouwendijk
# Vendor Homepage: http://goprayer.com/
# Software Link: https://wordpress.org/plugins/wp-prayer/
# Version: 1.6.1 and earlier
# Tested on: Windows 10
# Proof: https://bastijnouwendijk.com/cve-2021-24313/

Steps to exploit this vulnerability:

1. Log into the WordPress website with a user account, can be a user with any role
2. Go to the page where prayer or praise request can be made and fill in the requested information
3. In the 'prayer_messages' field of the prayer request form put the payload: <script>alert("XSS")</script>
4. Submit the form
5. Go to the page where the prayer requests are listed
6. The prayer requests are loaded and an alert is shown with text 'XSS' in the browser

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.