Read the docs
TI-2023-05200 Aliases CVE-2023-5653GHSA-4q47-vc82-p724

WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored XSS

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins

Why it matters now

EPSS 0.0051 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWassUp Real Time Analyticsup to 1.9.4.5—No fix listedCNA
  • WassUp Real Time Analytics VendorUnknown Affected up to 1.9.4.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wassup_real_time_analytics_project:wassup_real_time_analytics:*:*:*:*:*:wordpress:*:*up to 1.9.4.5VulnerableWassup Real Time Analytics Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5653
  2. 2026-10-03 Alias added: GHSA-4q47-vc82-p724

References

Exploit 1

  • TI-2016-08957 The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences