CVE-2023-0893

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Time Sheets	< 1.29.3

References

https://wpscan.com/vulnerability/fd6ef6ee-15e9-44ac-a2db-976393a3b71aExploit, Third Party Advisory
https://wpscan.com/vulnerability/fd6ef6ee-15e9-44ac-a2db-976393a3b71aExploit, Third Party Advisory

Timeline

Published: Apr 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08944.8The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allo CVE-2023-08954.9The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in ver CVE-2023-08968.8A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attack CVE-2023-08979.8Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, CVE-2023-08987.3General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the CVE-2023-08996.1The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the S CVE-2023-09007.2The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statemen CVE-2023-09015.3Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.CVE-2023-09025.4A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown CVE-2023-09038.8A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affect CVE-2023-09048.8A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unkn CVE-2023-09057.5A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function