Stored Cross-Site Scripting in JetAppointment Plugin for WordPress

The JetAppointment plugin for WordPress, developed by Crocoblock, is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.2.1. The flaw exists due to insufficient input sanitization and output escaping within the 'friendlyTime' parameter. An unauthenticated attacker can exploit this by sending a crafted HTTP POST request to the 'jet_engine_form_booking_submit' endpoint. The malicious payload is subsequently stored in the 'wp_jet_appointments_meta' database table. The payload executes in the browser of an administrator who views the appointment details within the WordPress admin dashboard, potentially leading to unauthorized administrative actions or session compromise.

Attack Chain

1. An attacker identifies the target WordPress site running a vulnerable version of JetAppointment.
2. The attacker crafts a malicious HTTP POST request targeting the 'jet_engine_form_booking_submit' endpoint.
3. The attacker includes a JavaScript payload within the 'friendlyTime' parameter of the request body.
4. The plugin fails to sanitize the input and saves the payload directly into the 'wp_jet_appointments_meta' table in the WordPress database.
5. An administrator logs into the WordPress dashboard and navigates to the appointment management section.
6. The plugin retrieves the malicious record and renders it in the appointment details popup.
7. The administrator's browser executes the stored JavaScript, enabling further malicious activity such as account creation or privilege escalation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a WordPress administrator's session. This could result in the unauthorized creation of administrative accounts, modification of site content, or the exfiltration of sensitive site configuration data. The vulnerability affects all users running JetAppointment version 2.5.2.1 or earlier.

Recommendation

Prioritized, concrete actions for detection engineering and security operations teams:

• Update the JetAppointment plugin to a patched version beyond 2.5.2.1 as soon as an update becomes available.
• Implement a Web Application Firewall (WAF) rule to block POST requests to 'jet_engine_form_booking_submit' that contain script tags or suspicious JavaScript patterns in the 'friendlyTime' parameter.
• Monitor web server access logs for anomalous POST activity to 'jet_engine_form_booking_submit' from external IP addresses.