WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Authenticated)

vendor:

WP Prayer

by:

Bastijn Ouwendijk

5.4

CVSS

MEDIUM

Stored Cross-Site Scripting (XSS)

CWE

Product Name: WP Prayer

Affected Version From: 1.6.1

Affected Version To: Earlier

Patch Exists: YES

Related CWE: CVE-2021-24313

CPE: 2.3:a:wordpress:wp_prayer

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10

2021

WordPress Plugin WP Prayer version 1.6.1 – ‘prayer_messages’ Stored Cross-Site Scripting (XSS) (Authenticated)

A stored cross-site scripting (XSS) vulnerability exists in WordPress Plugin WP Prayer version 1.6.1 and earlier. An authenticated user can inject malicious JavaScript code into the 'prayer_messages' field of the prayer request form. When the form is submitted, the malicious code is stored in the database and is executed when the page with the prayer requests is loaded. This can be used to steal user credentials or perform other malicious actions.

Mitigation:

Update to the latest version of the plugin.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2021-05-31
# Exploit Author: Bastijn Ouwendijk
# Vendor Homepage: http://goprayer.com/
# Software Link: https://wordpress.org/plugins/wp-prayer/
# Version: 1.6.1 and earlier
# Tested on: Windows 10
# Proof: https://bastijnouwendijk.com/cve-2021-24313/

Steps to exploit this vulnerability:

1. Log into the WordPress website with a user account, can be a user with any role
2. Go to the page where prayer or praise request can be made and fill in the requested information
3. In the 'prayer_messages' field of the prayer request form put the payload: <script>alert("XSS")</script>
4. Submit the form
5. Go to the page where the prayer requests are listed
6. The prayer requests are loaded and an alert is shown with text 'XSS' in the browser