wordpress wassup plugin vulnerabilities

Latest wordpress wassup plugin CVEs

Newest publication first

1. CVE-2012-2633 WassUp Real Time Analytics < 1.8.3.1 - Cross-Site Scripting

   Published 2012-06-15

   Medium·CVSS 4.3

   Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

2. CVE-2008-0520 WassUp Real Time Analytics 1.4 - 1.4.3 - SQL Injection

   Published 2008-01-31

   High·CVSS 7.5 Public exploit

   Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.