WordPress Plugin Vulnerability Report – Embed Calendly – Authenticated Stored Cross-Site Scripting – CVE-2023-4995

Q: What is cross-site scripting (XSS) and why is it dangerous?

What is cross-site scripting (XSS) and why is it dangerous? Cross-site scripting, also known as XSS, is a web vulnerability that allows attackers to inject malicious code into a website. This malicious code then gets executed in the browser of any user that visits the site. XSS vulnerabilities are dangerous because they can be used to steal session cookies, take over accounts, spread malware, or deface websites. Stored XSS like in this Calendly case is especially serious since the malicious script gets saved in the website's database and will execute for all visitors until it is removed.

Q: Could my WordPress site be affected even if I don't use the Calendly plugin?

Could my WordPress site be affected even if I don't use the Calendly plugin? Yes, your site could still be affected even if you don't use Calendly. This case highlights the importance of keeping all plugins, themes, and WordPress core up to date. Other plugins and themes can also contain dangerous vulnerabilities that leave sites compromised until they are patched. Outdated software is one of the biggest security threats to WordPress sites. Treat this vulnerability as a reminder to check that all your software is updated to the latest secure versions.

Q: How can I check if my site has been compromised by this vulnerability?

How can I check if my site has been compromised by this vulnerability? To check if your site is affected, first make sure you have updated to the latest version of Calendly if you use it. Then scan through your site content and look for any unauthorized or suspicious shortcodes that may have been added by an attacker exploiting this vulnerability. Also check for any unexpected changes to site content or appearance. If you find anything suspicious, restore from a recent clean backup. You can also install a security plugin like Wordfence to continually scan for malware.

Q: I use Calendly on client sites - what's my liability in the event of an exploit?

I use Calendly on client sites - what's my liability in the event of an exploit? As a developer or agency using third-party plugins like Calendly on client sites, you share some responsibility in keeping plugins updated and secure. Make sure your team has a process to monitor and rapidly deploy security updates for plugins used on client sites. Alert clients, especially those running outdated software, to update as soon as vulnerabilities are disclosed. Maintain regular backups you can restore if a site is compromised. Make security a priority in your development and hosting practices to limit liability.

Q: What can I do if my site was compromised before I upgraded Calendly?

What can I do if my site was compromised before I upgraded Calendly? If your site was compromised due to this vulnerability before you upgraded, first clean up any malicious code or content introduced by attackers. Scan for malware and change all passwords. Compare with a known good backup to find and remove any backdoors. Notify users about potential account breaches. Determine the scope of the damage and how attackers gained access. Harden site security to prevent future incidents. In severe cases, you may need to take the site offline, clean up on a staging server, and restore from backups.

Q: Should I switch from Calendly to an alternate scheduling plugin to be safe?

Should I switch from Calendly to an alternate scheduling plugin to be safe? The updated Calendly plugin is safe to continue using after you upgrade. But as a precaution, some users may opt to switch scheduling plugins, at least temporarily. Alternate plugins to consider include Caldera Forms, Simply Schedule Appointments, Bookly, or WP Simple Booking Calendar. Evaluate alternatives to find one that best fits your needs and has a strong security track record.

Q: How can I ensure my plugins and WordPress site stay secure going forward?

How can I ensure my plugins and WordPress site stay secure going forward? Some tips to improve overall WordPress security: Use only well-tested plugins from reputable developers. Limit plugins to only what's essential. Keep everything updated constantly, or enable automatic background updates. Perform frequent backups of your site. Use a secure managed WordPress hosting provider that handles updates and security for you. Install a firewall like Wordfence. Limit user roles and access. Follow WordPress hardening best practices.

Q: Should I report vulnerabilities if I find them in a plugin?

Should I report vulnerabilities if I find them in a plugin? Absolutely. If you discover a vulnerability in a plugin or theme, responsibly report it to the developer right away. Security researchers can also report through the WordPress plugin bug bounty program. This helps get vulnerabilities patched faster before they can be exploited. Whatever you do, avoid publishing details publicly before the developer has time to fix it, as that puts thousands of sites at risk.

Q: Is this Calendly vulnerability going to impact the company's business reputation?

Is this Calendly vulnerability going to impact the company's business reputation? Issues like this are quite common in the software industry and don't tend to hurt reputations by themselves if handled well. The Calendly developers responded admirably by releasing a patch in a very timely manner after private disclosure. This is a great example of the process working smoothly. Providing prompt security updates is a mark of good software. As long as the developer continues prioritizing security, this flaw is unlikely to have a major impact on their standing.

Q: Should I avoid Calendly and other third-party services because of potential security risks?

Should I avoid Calendly and other third-party services because of potential security risks? Reputable services like Calendly go through extensive security reviews and testing. The risks from integrating secure, quality software are minimal compared to the benefits. Every service has occasional vulnerabilities. As long as the vendor responds appropriately with rapid patches and transparency, it's fine to continue using their software with proper precautions like updates and backups. Avoid integrating new or unproven software without thorough vetting. Monitor integrations for emerging threats. With care, third-party services safely enhance WordPress sites.

By Your WP Guy | October 13, 2023

Plugin Name: Embed Calendly

Key Information:

Software Type: Plugin
Software Slug: embed-calendly-scheduling
Software Status: Active
Software Author: turn2honey
Software Downloads: 165,873
Active Installs: 20,000
Last Updated: October 13th, 2023
Patched Versions: 3.7
Affected Versions: <= 3.6

Vulnerability Details:

Name: Embed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVE: CVE-2023-4995
CVSS Score: 6.4
Publicly Published: October 12, 2023
Researcher: LanaCodes
Description: The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Summary:

The Embed Calendly plugin for WordPress has a vulnerability in versions up to and including 3.6 that allows authenticated attackers with contributor-level and above permissions to execute arbitrary web scripts via the 'calendly' shortcode. This vulnerability has been patched in version 3.7.

Detailed Overview:

This vulnerability, identified by researcher LanaCodes, is a critical security concern. The flaw is in the handling of user-supplied attributes within the 'calendly' shortcode, which is insufficiently sanitized and lacks proper output escaping. As a result, authenticated attackers with contributor-level and above permissions can inject malicious web scripts into pages. When users access these compromised pages, the injected scripts execute, potentially leading to various security risks, including data theft or manipulation.

Advice for Users:

Immediate Action: It is crucial for all users of the Embed Calendly plugin to update to version 3.7 or later immediately. This update contains the necessary security patches to address the vulnerability.

Check for Signs of Vulnerability: Users should thoroughly review their WordPress websites for any signs of compromise, such as unexpected script execution or unusual behavior. If any suspicious activity is detected, it should be investigated promptly.

Alternate Plugins: While a patch is available for Embed Calendly, users might consider alternative plugins that offer similar functionality as an extra precaution.

Stay Updated: Always ensure that your plugins are updated to the latest versions to avoid vulnerabilities. Regularly monitoring for plugin updates and promptly applying them is essential for maintaining a secure WordPress installation.

Conclusion:

The swift response from the plugin developers to patch this vulnerability underscores the importance of timely updates. Users are strongly advised to ensure they are running version 3.7 or later to secure their WordPress installations against potential exploitation of this vulnerability.

References:

Detailed Report:

Keeping Your WordPress Site Secure: A Case Study on the Embed Calendly Vulnerability

Keeping your WordPress website secure should be a top priority as a website owner. Unfortunately, vulnerabilities in plugins and themes occur frequently, leaving sites exposed if updates aren't applied promptly. One such vulnerability was recently disclosed in the popular Embed Calendly plugin, used by over 20,000 WordPress sites. This post covers the details of this vulnerability, how to update your site, and why staying on top of security is so critical.

About the Embed Calendly Plugin

The Embed Calendly plugin, with over 165,000 downloads, allows users to easily embed Calendly appointment scheduling calendars into WordPress pages and posts. This useful plugin was developed by turn2honey and currently has around 20,000 active installs.

Vulnerability Details

Researcher LanaCodes discovered a stored cross-site scripting (XSS) vulnerability affecting Embed Calendly versions 3.6 and below. This vulnerability allows users with contributor access or higher to inject malicious JavaScript code into pages via the Calendly shortcode.

This stored XSS vulnerability can be exploited to compromise user sessions, deface sites, redirect to malicious URLs, or otherwise compromise site security and integrity. The vulnerability received a relatively high severity score of 6.4 on the CVSS scale.

The researcher responsibly disclosed the vulnerability, which has been patched by the developers in version 3.7 of Embed Calendly through improved input validation and output encoding.

Impacts of the Vulnerability

This vulnerability is especially dangerous because any user with author or contributor access could exploit it, not just admins. On vulnerable sites, an attacker could potentially:

Steal or hijack user sessions
Deface sites by altering content
Redirect pages to malicious URLs
Install malware or backdoors
Access sensitive user or admin data
Launch further attacks on the site and server

Upgrading to Patch the Vulnerability

While the developer has patched this vulnerability in Embed Calendly version 3.7, many vulnerable sites likely have not yet updated. We highly recommend updating to the latest fixed release immediately to ensure your site is secure.

If you need any assistance updating plugins and themes, our team of WordPress experts can help ensure your site is locked down tight.

The Importance of Staying on Top of Vulnerabilities

This vulnerability highlights why it's so critical to stay on top of security updates for WordPress and all plugins and themes. Outdated software is one of the biggest threats to WordPress site security today.

Even if you don't use this particular vulnerable plugin, treat this case study as a reminder to check that all your plugins, themes, and WordPress core are running the absolute latest versions. Don't leave the door open for attackers.

As a busy small business owner, staying on top of security can feel daunting. But with the help of managed WordPress hosting providers and experts, you can ensure your site is secure, updated, and safe.

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.

WordPress Plugin Vulnerability Report – Embed Calendly – Authenticated Stored Cross-Site Scripting – CVE-2023-4995 FAQs

What is cross-site scripting (XSS) and why is it dangerous?

Cross-site scripting, also known as XSS, is a web vulnerability that allows attackers to inject malicious code into a website. This malicious code then gets executed in the browser of any user that visits the site. XSS vulnerabilities are dangerous because they can be used to steal session cookies, take over accounts, spread malware, or deface websites. Stored XSS like in this Calendly case is especially serious since the malicious script gets saved in the website's database and will execute for all visitors until it is removed.

Could my WordPress site be affected even if I don't use the Calendly plugin?

Yes, your site could still be affected even if you don't use Calendly. This case highlights the importance of keeping all plugins, themes, and WordPress core up to date. Other plugins and themes can also contain dangerous vulnerabilities that leave sites compromised until they are patched. Outdated software is one of the biggest security threats to WordPress sites. Treat this vulnerability as a reminder to check that all your software is updated to the latest secure versions.

How can I check if my site has been compromised by this vulnerability?

To check if your site is affected, first make sure you have updated to the latest version of Calendly if you use it. Then scan through your site content and look for any unauthorized or suspicious shortcodes that may have been added by an attacker exploiting this vulnerability. Also check for any unexpected changes to site content or appearance. If you find anything suspicious, restore from a recent clean backup. You can also install a security plugin like Wordfence to continually scan for malware.

I use Calendly on client sites - what's my liability in the event of an exploit?

As a developer or agency using third-party plugins like Calendly on client sites, you share some responsibility in keeping plugins updated and secure. Make sure your team has a process to monitor and rapidly deploy security updates for plugins used on client sites. Alert clients, especially those running outdated software, to update as soon as vulnerabilities are disclosed. Maintain regular backups you can restore if a site is compromised. Make security a priority in your development and hosting practices to limit liability.

What can I do if my site was compromised before I upgraded Calendly?

If your site was compromised due to this vulnerability before you upgraded, first clean up any malicious code or content introduced by attackers. Scan for malware and change all passwords. Compare with a known good backup to find and remove any backdoors. Notify users about potential account breaches. Determine the scope of the damage and how attackers gained access. Harden site security to prevent future incidents. In severe cases, you may need to take the site offline, clean up on a staging server, and restore from backups.

Should I switch from Calendly to an alternate scheduling plugin to be safe?

The updated Calendly plugin is safe to continue using after you upgrade. But as a precaution, some users may opt to switch scheduling plugins, at least temporarily. Alternate plugins to consider include Caldera Forms, Simply Schedule Appointments, Bookly, or WP Simple Booking Calendar. Evaluate alternatives to find one that best fits your needs and has a strong security track record.

How can I ensure my plugins and WordPress site stay secure going forward?

Some tips to improve overall WordPress security: Use only well-tested plugins from reputable developers. Limit plugins to only what's essential. Keep everything updated constantly, or enable automatic background updates. Perform frequent backups of your site. Use a secure managed WordPress hosting provider that handles updates and security for you. Install a firewall like Wordfence. Limit user roles and access. Follow WordPress hardening best practices.

Should I report vulnerabilities if I find them in a plugin?

Absolutely. If you discover a vulnerability in a plugin or theme, responsibly report it to the developer right away. Security researchers can also report through the WordPress plugin bug bounty program. This helps get vulnerabilities patched faster before they can be exploited. Whatever you do, avoid publishing details publicly before the developer has time to fix it, as that puts thousands of sites at risk.

Is this Calendly vulnerability going to impact the company's business reputation?

Issues like this are quite common in the software industry and don't tend to hurt reputations by themselves if handled well. The Calendly developers responded admirably by releasing a patch in a very timely manner after private disclosure. This is a great example of the process working smoothly. Providing prompt security updates is a mark of good software. As long as the developer continues prioritizing security, this flaw is unlikely to have a major impact on their standing.

Should I avoid Calendly and other third-party services because of potential security risks?

Reputable services like Calendly go through extensive security reviews and testing. The risks from integrating secure, quality software are minimal compared to the benefits. Every service has occasional vulnerabilities. As long as the vendor responds appropriately with rapid patches and transparency, it's fine to continue using their software with proper precautions like updates and backups. Avoid integrating new or unproven software without thorough vetting. Monitor integrations for emerging threats. With care, third-party services safely enhance WordPress sites.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged Active Installs, Authenticated Attack, CVE-2023-4995, CVSS Score 6.4, Cybersecurity, data protection, Embed Calendly Plugin, Input Sanitization, LanaCodes, Output Escaping, Patched Version 3.7, Plugin Maintenance, Plugin Vulnerability, Security Advisory., Security Best Practices, Security Patch, Security Update, Shortcode Vulnerability, Site Integrity, Software Update, Stored Cross-Site Scripting, turn2honey, User Safety, Version 3.6, Vulnerability Management, Web safety, Website Management, WordPress, WordPress Community, wordpress plugins, wordpress security, XSS