CVE-2024-54220: FAT Services Booking XSS Vulnerability

CVE-2024-54220 Overview

CVE-2024-54220 is a stored Cross-Site Scripting (XSS) vulnerability in the roninwp FAT Services Booking plugin for WordPress. The flaw affects all plugin versions up to and including 5.6. Attackers with subscriber-level access can inject malicious JavaScript that persists site-wide and executes in the browsers of administrators and other visitors. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
A low-privileged authenticated user can store JavaScript that runs in administrator sessions, enabling account takeover, content manipulation, and pivoting to higher-impact attacks against the WordPress site.

Affected Products

roninwp FAT Services Booking plugin for WordPress
All versions from n/a through 5.6
WordPress sites with the fat-services-booking plugin installed and active

Discovery Timeline

2024-12-09 - CVE-2024-54220 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54220

Vulnerability Analysis

The FAT Services Booking plugin fails to properly neutralize user-supplied input before rendering it within web pages. An authenticated attacker holding only the WordPress Subscriber role can submit crafted input containing HTML and JavaScript payloads. The plugin stores this input and later renders it without adequate output encoding or input sanitization.

Because the injected script is stored server-side, it persists across sessions and executes whenever a victim loads the affected page. The scope change in the CVSS vector indicates the payload can affect resources beyond the vulnerable component, including the WordPress administrative interface. Successful exploitation allows attackers to hijack authenticated sessions, perform administrative actions on behalf of victims, or redirect users to attacker-controlled infrastructure.

Root Cause

The root cause is missing or insufficient sanitization of user input combined with absent contextual output escaping. The plugin trusts data submitted by authenticated users without applying WordPress sanitization functions such as sanitize_text_field() on input or esc_html() and esc_attr() on output. This pattern matches CWE-79, Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the WordPress site and a valid Subscriber account, which is often available through self-registration on sites that permit user signup. The attacker submits a payload through a plugin-controlled input field. When an administrator or other privileged user later views the rendered content, the script executes in their browser context. User interaction from the victim is required, which is consistent with the UI:R component in the CVSS vector.

For technical specifics, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-54220

Indicators of Compromise

Unexpected <script>, <iframe>, or onerror= patterns stored in plugin database tables associated with fat-services-booking
Outbound requests from administrator browsers to unfamiliar domains shortly after viewing plugin-rendered pages
New WordPress administrator accounts or modified user roles created without legitimate change records
Subscriber accounts submitting booking-related fields containing HTML or JavaScript syntax

Detection Strategies

Audit WordPress wp_options and plugin-specific tables for entries containing HTML tags or JavaScript event handlers
Review web server access logs for POST requests to plugin endpoints from Subscriber-level accounts followed by administrator page views
Enable WordPress activity logging plugins to track content submissions and rendering by low-privilege users
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution from plugin pages

Monitoring Recommendations

Monitor creation of low-privilege WordPress accounts on sites that do not require public registration
Alert on administrator session activity originating from anomalous IP addresses or user agents
Track installed plugin versions across WordPress fleets and flag any fat-services-booking instance at 5.6 or earlier

How to Mitigate CVE-2024-54220

Immediate Actions Required

Update the FAT Services Booking plugin to a version newer than 5.6 once the vendor releases a patched release
Disable or remove the fat-services-booking plugin if a patched version is not yet available
Restrict new user registrations or set the default role to one that cannot interact with the plugin
Audit existing subscriber accounts and remove any that cannot be attributed to legitimate users

Patch Information

At the time of the latest NVD update, the advisory lists affected versions through 5.6 with no fixed version confirmed in the available data. Monitor the Patchstack Vulnerability Report and the official plugin page on WordPress.org for an updated release addressing CVE-2024-54220.

Workarounds

Deploy a Web Application Firewall (WAF) with rules that block HTML and script payloads submitted to plugin endpoints
Apply a strict Content Security Policy that disallows inline scripts and unknown external script origins
Temporarily disable the plugin on production sites until a patched version is verified
Force a password reset for all administrator accounts if exploitation is suspected

bash

# Disable the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate fat-services-booking

# Remove the plugin entirely if it is not required
wp plugin uninstall fat-services-booking

# List subscriber accounts for audit
wp user list --role=subscriber --fields=ID,user_login,user_email,user_registered