CVE-2022-0834
📋 TL;DR
The Amelia WordPress plugin has a stored cross-site scripting (XSS) vulnerability in versions up to 1.0.46. Attackers can inject malicious scripts via the lastName parameter in booking calendar entries, which execute when users view those entries. This affects all WordPress sites using vulnerable Amelia plugin versions.
💻 Affected Systems
- Amelia WordPress Booking Plugin
📦 What is this software?
Amelia by Wpamelia
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites.
Likely Case
Attackers inject malicious scripts that steal user session data or perform limited unauthorized actions when users view compromised booking entries.
If Mitigated
With proper input validation and output escaping, malicious scripts would be neutralized before execution.
🎯 Exploit Status
Exploitation requires creating or modifying booking entries with malicious payloads in the lastName field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.0.47 and later
Vendor Advisory: https://wordpress.org/plugins/ameliabooking/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Amelia plugin and click 'Update Now'
4. Verify version is 1.0.47 or higher
🔧 Temporary Workarounds
Input Validation Filter
allAdd custom input validation for lastName parameter
Add sanitization filter in WordPress functions.php or custom plugin
🧯 If You Can't Patch
- Disable the Amelia plugin temporarily
- Implement web application firewall (WAF) rules to block XSS payloads in lastName parameter
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Amelia → Version number. If version is 1.0.46 or lower, system is vulnerable.Check Version:
wp plugin get ameliabooking --field=versionVerify Fix Applied:
After updating, verify version is 1.0.47 or higher and test booking functionality with safe test payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual booking entries with script tags in lastName field
- Multiple failed booking attempts with suspicious parameters
Network Indicators:
- HTTP requests with script tags in lastName parameter
- Unusual outbound connections from booking pages
SIEM Query:
source="wordpress" AND ("lastName" AND ("<script>" OR "javascript:" OR "onerror="))🔗 References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/73f12f22-c0a4-4010-9634-ce7308254028?source=cve
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0834
- https://www.wordfence.com/threat-intel/vulnerabilities/id/73f12f22-c0a4-4010-9634-ce7308254028?source=cve
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0834
