CVE-2012-2633: XSS
First published: Fri Jun 15 2012(Updated: )
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Credit: vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wordpress Wassup Plugin | <=1.8.3 | |
| Wordpress Wassup Plugin | =1.4 | |
| Wordpress Wassup Plugin | =1.4.3 | |
| Wordpress Wassup Plugin | =1.7.2 | |
| Wordpress Wassup Plugin | =1.7.2.1 | |
| Wordpress Wassup Plugin | =1.8 | |
| Wordpress Wassup Plugin | =1.8.1 | |
| Wordpress Wassup Plugin | =1.8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://jvn.jp/en/jp/JVN15646988/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2012-000058
- http://osvdb.org/82017
- http://plugins.trac.wordpress.org/changeset?old_path=%2Fwassup&old=545369&new_path=%2Fwassup&new=545369
- http://wordpress.org/extend/plugins/wassup/changelog/
- http://www.wpwp.org/archives/wassup-1-8-3-1/
Frequently Asked Questions
What is the severity of CVE-2012-2633?
CVE-2012-2633 is classified as a medium severity vulnerability due to its potential impact on website security via XSS attacks.
How do I fix CVE-2012-2633?
To fix CVE-2012-2633, update the WassUp plugin to version 1.8.3.1 or later.
Which versions of the WassUp plugin are affected by CVE-2012-2633?
CVE-2012-2633 affects WassUp plugin versions up to 1.8.3.
What type of vulnerability is CVE-2012-2633?
CVE-2012-2633 is a Cross-Site Scripting (XSS) vulnerability.
Can CVE-2012-2633 be exploited remotely?
Yes, remote attackers can exploit CVE-2012-2633 by injecting malicious scripts through the User-Agent HTTP header.
- collector/nvd-index
- agent/severity
- agent/author
- agent/type
- agent/weakness
- agent/references
- agent/description
- agent/tags
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- vendor/wordpress
- canonical/wordpress wassup plugin
- version/wordpress wassup plugin/1.8.3
- version/wordpress wassup plugin/1.4
- version/wordpress wassup plugin/1.4.3
- version/wordpress wassup plugin/1.7.2
- version/wordpress wassup plugin/1.7.2.1
- version/wordpress wassup plugin/1.8
- version/wordpress wassup plugin/1.8.1
- version/wordpress wassup plugin/1.8.2