CVE-2024-3966: Projectcaruso Pray For Me

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin

Affected products

• Projectcaruso Pray For Me: up to and including 1.0.4

Published 2024-06-14. Last modified 2026-06-17.