CVE-2021-24313

The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://bastijnouwendijk.com/cve-2021-24313/	Exploit Technical Description Third Party Advisory
https://wpscan.com/vulnerability/c7ab736d-27c4-4ec5-9681-a3f0dda86586	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:goprayer:wp_prayer:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2021-06-01 14:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-24313

Mitre link : CVE-2021-24313

CVE.ORG link : CVE-2021-24313

JSON object : View

Products Affected

goprayer

wp_prayer

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-24313", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-06-01T14:15:08.920", "references": [{"url": "https://bastijnouwendijk.com/cve-2021-24313/", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/c7ab736d-27c4-4ec5-9681-a3f0dda86586", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads."}, {"lang": "es", "value": "El plugin WP Prayer WordPress versiones anteriores a 1.6.2, proporciona la funcionalidad para almacenar oraciones/alabanzas requeridas y enumerardas en un sitio web de WordPress. Estas peticiones de oraci\u00f3n/alabanza almacenados puede ser listadas usando el motor de oraci\u00f3n de WP. Un usuario de WordPress autenticado con cualquier funci\u00f3n puede completar el formulario para pedir una oraci\u00f3n. El formulario para pedir oraciones o alabanzas tiene varios campos. Los campos \"prayer request\" y \"praise request\" no usan la comprobaci\u00f3n de entrada adecuada y puede sern usar para almacenar cargas \u00fatiles de tipo XSS"}], "lastModified": "2021-06-11T19:49:41.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:goprayer:wp_prayer:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "C06FDBAF-50AA-428C-96B6-10C70E5E1743", "versionEndExcluding": "1.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}