What is CVE-2021-24313?

CVE-2021-24313 is a medium-severity vulnerability in Goprayer Wp Prayer, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-06-01.

How severe is CVE-2021-24313?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2021-24313 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Goprayer Wp Prayer

CVE-2021-24313

The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Goprayer Wp_prayer
Unknown Wp Prayer — versions 1.6.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

contact@wpscan.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
contact@wpscan.com (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-24313?: CVE-2021-24313 is a medium-severity vulnerability in Goprayer Wp Prayer, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-06-01.
How severe is CVE-2021-24313?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2021-24313 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.