Security feature bypass

The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::addsiteurl method, a different vulnerability than CVE-2012-2633...

CVE-2012-2633

Cross-site scripting XSS vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2012-2633

The CVE-2012-2633 entry concerns a Cross-site scripting (XSS) vulnerability in the WassUp WordPress plugin, specifically in wassup.php, allowing an attacker to inject arbitrary script/HTML via the User-Agent header. Affected versions are WassUp for WordPress before 1.8.3.1. Mitigation noted in so...