Daily Prayer Time < 2021.08.10 – Admin+ Stored XSS | CVE 2021-24523 | Plugin Vulnerabilities

Description

The plugin does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.

Proof of Concept

Put the following payload in the Fajr, Sunrise, Zuhr, Asr, Maghrib and/or Isha field of the Language settings of the plugin (/wp-admin/admin.php?page=dpt#tabs-2): <img/src/onerror=prompt(/XSS/)>

The XSS will be triggered in the plugin's settings, as well as any post/page with the [monthlytable] embed

Affects Plugins

daily-prayer-time-for-mosques

Fixed in 2021.08.10

References

CVE

URL

https://www.hackpertise.com/cve/11-cve-2021-24523/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

832fe086-1d33-430b-bdb5-e444761576b2

Timeline

Publicly Published

2021-08-10 (about 4 years ago)

Added

2021-08-10 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2015-01-17

Title

Esplanade 1.1.4 - Reflected XSS

Published

2024-10-15

Title

Akismet htaccess writer <= 1.0.1 - Reflected Cross-Site Scripting

Published

2024-11-11

Title

Slickstream: Engagement and Conversions < 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode

Published

2025-07-15

Title

Brandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

Published

2014-08-01

Title

Your Text Manager < 0.3.0 - Cross-Site Scripting (XSS)