CVE-2024-4462

The Nafeza Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://wordpress.org/plugins/nafeza-prayer-time/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/efbf83d9-ce5e-4139-ba12-b00df4d9ad89?source=cve
• https://wordpress.org/plugins/nafeza-prayer-time/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/efbf83d9-ce5e-4139-ba12-b00df4d9ad89?source=cve

Published

Jun 4, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4459The Themesflat Addons For Elementor plugin for WordPress is …5.4
• CVE-2024-44598FNT Command 13.4.0 is vulnerable to Code Execution via the C…8.8
• CVE-2024-44599FNT Command 13.4.0 is vulnerable to Directory Traversal.8.3
• CVE-2024-4460Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-4461Unquoted path or search item vulnerability in SugarSync vers…7.8
• CVE-2024-44610PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gate…5.6
• CVE-2024-44623An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remot…9.8
• CVE-2024-44625Gogs <=0.13.0 is vulnerable to Directory Traversal via the e…8.8
• CVE-2024-4463The Squelch Tabs and Accordions Shortcodes plugin for WordPr…4.3
• CVE-2024-44630Multiple parameters in register.php in PHPGurukul Student Re…6.5
• CVE-2024-44632PHPGurukul Student Record System 3.20 is vulnerable to SQL I…6.5
• CVE-2024-44633PHPGurukul Student Record System 3.20 is vulnerable to SQL I…6.5