CVE-2023-1890

MEDIUMNuclei

Tablesome < 1.0.9 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-1890 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 24, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Tablesome

Default status: unaffected

CVE ListBefore 1.0.9affected

Nuclei templates

1
ProjectDiscoveryMEDIUMTablesome < 1.0.9 - Cross-Site ScriptingCVSS 6.1

Tablesome before 1.0.9 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Fixed in version 1.0.9.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvewpscanwpwp-pluginwordpressauthenticatedxsstablesomepauplevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:pauple:tablesome:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/8ef64490-30cd-4e07-9b7c-64f551944f3d https://wordpress.org/plugins/tablesome/ https://nvd.nist.gov/vuln/detail/CVE-2023-1890

Source: ProjectDiscovery

References

3