CVE-2023-1890

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-18916.1The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notCVE-2023-18929.6Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.CVE-2023-18936.1The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a CVE-2023-18945.3A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to speciCVE-2023-18959.6The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpointCVE-2023-18977.5Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could alloCVE-2023-18987.5Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve dCVE-2023-18997.5Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information bCVE-2023-19005.5A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This couldCVE-2023-19018.0The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicCVE-2023-19028.0The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a maliciousCVE-2023-19034.3SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the
CVE-2023-1890: Medium severity, CVSS 6.1 | Vulnix