PT-2023-6573 · WordPress · Tablesome

Taurus Omar · Publicado 2023-04-24 · Atualizado 2025-01-24 · CVE-2023-1890

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tablesome WordPress plugin versions prior to 1.0.9

Description The issue is related to the Tablesome WordPress plugin, which does not properly escape generated URLs before outputting them in attributes when certain notices are displayed. This leads to Reflected Cross-Site Scripting, allowing a remote attacker to conduct inter-site script attacks.

Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue. As a temporary workaround, consider disabling the display of notices that contain generated URLs until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-07337

CVE-2023-1890

Produtos afetados

Tablesome

Referências · 7

• 🔥 http://packetstormsecurity.com/files/173727/WordPress-Tablesome-Cross-Site-Scripting.html · Exploit
• 🔥 https://wpscan.com/vulnerability/8ef64490-30cd-4e07-9b7c-64f551944f3d · Exploit
• https://bdu.fstec.ru/vul/2023-07337 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-1890 · Nota de Segurança
• https://t.me/cibsecurity/64113 · Publicação no Telegram
• https://t.me/cvenotify/108580 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1890 · Aviso do Fabricante