Salat Times < 3.2.2 – Admin+ Stored Cross-Site Scripting | CVE 2022-2983 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Put the following payload in any text field of Settings > Salat Times: "><img src onerror=alert(/XSS/)>

Save, and the XSS will be triggered when accessing the settings again.

The payload will also be triggered in pages where the [daily_salat_times] is embedded.

Affects Plugins

Fixed in 3.2.2

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Submitter website

https://www.hackpertise.com/

Verified

Yes

WPVDB ID

e2af8c7f-9bd4-4902-8df8-72ffb414fdbf

Timeline

Publicly Published

2022-11-02 (about 3 years ago)

Added

2022-11-02 (about 3 years ago)

Last Updated

2022-11-02 (about 3 years ago)

Other

Published

Title

Published

2019-06-28

Title

Watu Quizz < 3.1.2.6 - Reflected XSS via question-form.html.php

Published

2024-10-23

Title

WP Adminify – Best WordPress Custom Dashboard Plugin < 4.0.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2024-02-29

Title

Exclusive Addons for Elementor < 2.6.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget

Published

2023-02-13

Title

Beautiful Cookie Consent Banner < 2.10.2 - Unauthenticated Stored XSS

Published

2025-06-23

Title

xili-dictionary <= 2.12.5.2 - Reflected Cross-Site Scripting