VULNERABILITY INTELLIGENCE

CVE-2021-24313

CVSS score5.4 MEDIUM

EPSS probability0.70%

CISA KEVNot currently listed

Published2021-06-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.

Weakness classification

contact@wpscan.com: CWE-79

Primary references

contact@wpscan.com — Exploit, Technical Description, Third Party Advisory
contact@wpscan.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory