CVE-2023-5653 WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored XSS

2023-11-2716:22:01

WPScan

www.cve.org

cve-2023-5653

wordpress

unauthenticated stored xss

ip address

admin page

security vulnerability

0.001 Low

EPSS

Percentile

30.3%

JSON

The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WassUp Real Time Analytics",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "1.9.4.5"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/76316621-1987-44ea-83e5-6ca884bdd1c0

0.001 Low

EPSS

Percentile

30.3%

JSON

Related for CVELIST:CVE-2023-5653