What’s Vulnerable › Vulnerabilities

CVE-2023-5653: WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored XSS

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-27 · updated 2026-06-17
• Weakness: CWE-79

Description

The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins

Affected products

• WassUp Real Time Analytics: through 1.9.4.5

References

• https://wpscan.com/vulnerability/76316621-1987-44ea-83e5-6ca884bdd1c0
• https://wpscan.com/vulnerability/76316621-1987-44ea-83e5-6ca884bdd1c0

Get alerted when CVE-2023-5653 or the next vulnerability affects your stack