CVE-2024-11886

Vulnerability

A stored cross-site scripting vulnerability exists in the Contact Form and Calls To Action by vcita plugin for WordPress, up to and including version 2.7.1 [1][2]. The flaw resides in the plugin's vCitaMeetingScheduler shortcode handler, which fails to properly sanitize user-supplied attributes and escape output [1][2]. This allows attributes like title, width, or height to contain arbitrary JavaScript that is injected into the page HTML and later executed in the browser of any visitor viewing the affected page [1][2].

Exploitation

An attacker must have an account with at least contributor-level access on the target WordPress site [1][2]. With that access, the attacker creates or edits a post or page and includes the [vCitaMeetingScheduler] shortcode with a malicious payload in one of its attributes, such as title [1][2]. No other privileges or user interaction beyond viewing the page is required; the injected script executes automatically when any user accesses the crafted page [1][2].

Impact

Successful exploitation results in arbitrary JavaScript execution in the context of the victim's browser session on the affected WordPress site [1][2]. This can lead to session hijacking, defacement, theft of authentication cookies, or redirection to malicious sites, compromising the confidentiality and integrity of the site and its users [1][2]. The attacker can also use this to impersonate other users or escalate privileges if combined with other vulnerabilities [1][2].

Mitigation

The vendor has not released a patched version as of the publication date; however, users should update to the latest available version once it is provided [1][2]. As a workaround, site administrators can restrict contributor-level access to trusted users only, disable the vulnerable shortcode via WordPress filters, or use a web application firewall to block malicious attribute patterns [1][2]. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of this writing.