PT-2023-6573 · WordPress · Tablesome

Taurus Omar · Published 2023-04-24 · Updated 2025-01-24 · CVE-2023-1890

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tablesome WordPress plugin versions prior to 1.0.9

Description The issue is related to the Tablesome WordPress plugin, which does not properly escape generated URLs before outputting them in attributes when certain notices are displayed. This leads to Reflected Cross-Site Scripting, allowing a remote attacker to conduct inter-site script attacks.

Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue. As a temporary workaround, consider disabling the display of notices that contain generated URLs until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07337

CVE-2023-1890

Affected Products

Tablesome

References · 7

• 🔥 http://packetstormsecurity.com/files/173727/WordPress-Tablesome-Cross-Site-Scripting.html · Exploit
• 🔥 https://wpscan.com/vulnerability/8ef64490-30cd-4e07-9b7c-64f551944f3d · Exploit
• https://bdu.fstec.ru/vul/2023-07337 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-1890 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1890 · Vendor Advisory
• https://t.me/cibsecurity/64113 · Telegram Post
• https://t.me/cvenotify/108580 · Telegram Post