WordPress Plugin Vulnerabilities

Daily Prayer Time < 2023.05.05 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
daily-prayer-time-for-mosques
Fixed in 2023.05.05

References

CVE
CVE-2023-27631

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
yuyudhn
Verified
No
WPVDB ID
8713c12d-ceb9-47b8-8f42-cd4403a1222c

Timeline

Publicly Published
2023-03-08 (about 3 years ago)
Added
2023-06-22 (about 2 years ago)
Last Updated
2023-08-07 (about 2 years ago)

Other

Published
Title
Published
2025-02-27
Title
Site Mailer < 1.2.4 - Unauthenticated Stored Cross-Site Scripting
Published
2023-03-21
Title
Lazy Social Comments < 2.0.5 - Admin+ Stored Cross-Site Scripting
Published
2025-11-13
Title
Booking Calendar < 10.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-10-17
Title
Complete Open Graph <= 3.4.5 - Admin+ Stored XSS
Published
2025-08-14
Title
Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter