CVE-2022-0785: Daily Prayer Time Project Daily Prayer Time

Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days.

The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection

Affected products

• Daily Prayer Time Project Daily Prayer Time: before 2022.03.01 (fixed in 2022.03.01)

Published 2022-04-18. Last modified 2026-06-17.