Daily Prayer Time For Mosques Vulnerabilities

The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all versions up to, and including, 2024.08.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVSS:

9.9

Affected:

up to 2024.08.26

Fixed in:

2024.09.14

Disclosed:

Sep 24, 2024

CVE-2024-8621 on NVD →

The Daily Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2023.10.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribut...

CVSS:

6.4

Affected:

up to 2023.10.13

Fixed in:

2023.10.21

Disclosed:

Nov 15, 2023

CVE-2023-47817 on NVD →

The Daily Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2023.03.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level access, and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 2023.03.20

Fixed in:

2023.05.05

Disclosed:

Mar 8, 2023

CVE-2023-27631 on NVD →

The Daily Prayer Time plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2023.03.08. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions such as modifying plugin settings via a forged r...

CVSS:

5.4

Affected:

up to 2023.03.08

Fixed in:

2023.03.17

Disclosed:

Mar 8, 2023

CVE-2023-27632 on NVD →

The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection

CVSS:

9.8

Affected:

up to 2022.03.01

Fixed in:

2022.03.01

Disclosed:

Apr 13, 2022

CVE-2022-0785 on NVD →

The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.

CVSS:

5.4

Affected:

up to 2021.08.10

Fixed in:

2021.08.10

Disclosed:

Aug 10, 2021

CVE-2021-24523 on NVD →