Medium severity · published Nov 27, 2023
CVE-2023-5653
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing…
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
Wassup Real Time Analytics · Wassup Real Time Analytics Project
through 1.9.4.5 · source: NVD
Affected product
WR
Wassup Real Time Analytics
Wassup Real Time Analytics Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5653
Exploit
https://wpscan.com/vulnerability/76316621-1987-44ea-83e5-6ca884bdd1c0
More from Wassup Real Time Analytics
6.1
CVE-2016-10919
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633