CVE-2024-10703 – Registrations for Events Calendar – Stored XSS to JS Backdoor Creation – POC

Stored Cross-Site Scripting (Stored XSS) is a critical web security vulnerability that allows attackers to inject malicious scripts into a website, which are then executed in the browsers of unsuspecting users. This article focuses on CVE-2024-10703, a Stored XSS vulnerability found in versions below 2.13.4 of the “Registrations for The Events Calendar” plugin for WordPress. This vulnerability can be exploited by an attacker with administrator privileges to inject harmful scripts that execute when users interact with certain elements of the website.

CVE	CVE-2024-10703
Plugin	Registration for Events Calendar < 2.3.14
Critical	High
All Time	358 193
Active installations	9 000+
Publicly Published	March 11, 2025
Last Updated	March 11, 2025
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10703 https://wpscan.com/vulnerability/5601ac03-09e4-4b4e-b03e-98323bd36dba/
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

Security researchers identified a flaw in the “Registrations for The Events Calendar” plugin, which is commonly used to manage event registrations on WordPress sites. The vulnerability exists in the Custom Text/Labels settings within the Form Settings panel. Specifically, the plugin fails to properly sanitize user input when saving custom display labels, allowing an attacker to inject malicious JavaScript code.

Understanding of XSS attack’s

Stored XSS vulnerabilities occur when a web application stores unvalidated user input that later gets served to other users without proper sanitization. In WordPress plugins, improper handling of user-generated content in settings, comments, or form fields can introduce such vulnerabilities.

For example, a typical stored XSS attack involves injecting a script into a website’s settings or database. When another user visits a compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or redirection to phishing sites.

Real-world examples of stored XSS vulnerabilities in WordPress include cases where plugins failed to sanitize input fields in comment sections, widget settings, or form fields, leading to widespread attacks.

Exploiting the XSS Vulnerability

A proof-of-concept (PoC) exploit for CVE-2024-10703 involves injecting a simple JavaScript payload into the Custom Text/Labels settings. An example payload is:

POC:

1) Navigate to the Registration plugin panel.
2) Access the Form Settings section.
3) Locate the "Custom Text/Labels" settings under Display.
4) Inject an XSS payload into the template form and save the settings.
5) Hover over the affected element to trigger the injected JavaScript.

____

Once injected, this payload will execute JavaScript when an unsuspecting user hovers over the affected element. In a more advanced attack scenario, an attacker could steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users.

Recommendations for Improved Security

To mitigate the risks associated with CVE-2024-10703, WordPress site administrators and plugin developers should implement the following security measures:

1. Update the Plugin: Ensure that “Registrations for The Events Calendar” is updated to version 2.13.4 or later, where the issue is patched.
2. Input Validation & Sanitization: Use WordPress’s built-in functions like sanitize_text_field() and esc_html() to prevent XSS.
3. Content Security Policy (CSP): Implement a CSP header to restrict the execution of inline scripts.
4. Use a Web Application Firewall (WAF): A WAF can help detect and block malicious input before it reaches the server.
5. Limit Privileges: Restrict access to plugin settings to trusted administrators only.
6. Security Audits: Regularly perform security audits and vulnerability assessments on WordPress plugins.

To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-10703, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

artyom k.