Stored XSS Vulnerability in Bookly WordPress Plugin

The Bookly WordPress plugin (versions 27.7 and earlier) is vulnerable to a stored Cross-Site Scripting (XSS) attack. This vulnerability arises from insufficient input sanitization and output escaping within the 'bookly_speed_up_update_addons' AJAX action. Because this action is registered as 'wp_ajax_nopriv', it is accessible to unauthenticated attackers.

An attacker can submit a crafted AJAX request to the plugin that lacks a valid signature. The plugin stores the malicious input within the 'bookly_log' table in the 'details' column. The payload executes in the browser of any administrator who navigates to the 'Diagnostics → Logs' page within the WordPress dashboard. This facilitates administrative session hijacking, unauthorized configuration changes, or the execution of arbitrary JavaScript within the context of the WordPress admin panel. Defenders should prioritize updating to the patched version once available and monitor logs for anomalous AJAX requests to the vulnerable endpoint.

Attack Chain

1. Attacker identifies a WordPress site running a vulnerable version of the Bookly plugin (<= 27.7).
2. Attacker crafts an HTTP POST request targeting the 'wp-admin/admin-ajax.php' endpoint.
3. Attacker sets the 'action' parameter to 'bookly_speed_up_update_addons'.
4. Attacker inserts a JavaScript payload into the request parameters intended for the 'details' field.
5. The plugin fails to validate the request signature and writes the unsanitized payload into the 'bookly_log' table.
6. An administrator accesses the 'Diagnostics → Logs' page in the WordPress admin dashboard.
7. The browser renders the stored JavaScript payload, executing it in the administrator's security context.
8. Attacker leverages the hijacked administrative session to further compromise the WordPress site.

Impact

Successful exploitation allows unauthenticated attackers to achieve Stored XSS against WordPress administrators. This can lead to full administrative account takeover, site defacement, unauthorized plugin installation, or redirection of site visitors to malicious infrastructure, significantly impacting the integrity and availability of the web application.

Recommendation

• Update the Bookly plugin to the latest version immediately once a patch is provided by the vendor.
• Implement WAF rules to detect and block POST requests to 'admin-ajax.php' containing the 'action=bookly_speed_up_update_addons' parameter and suspicious script-related characters.
• Deploy the Sigma rule below to monitor for exploitation attempts targeting the vulnerable AJAX action.