6.1

CVE-2023-5653

Exploit

WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored XSS

WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored Cross-Site Scripting via IP

The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
Mögliche Gegenmaßnahme
WassUp Real Time Analytics: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wassup Real Time Analytics Project ≫ Wassup Real Time Analytics SwPlatformwordpress Version <= 1.9.4.5
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WassUp Real Time Analytics
Version *-1.9.4.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.393
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://wpscan.com/vulnerability/76316621-1987-44ea-83e5-6ca884bdd1c0
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/b5318c2d-7b58-4830-bbc0-6d160968290f
Third Party Advisory