CVE-2023-1893

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Login Configurator	<= 2.1

References

http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory
https://wpscan.com/vulnerability/dbe6cf09-971f-42e9-b744-9339454168c7Exploit, Third Party Advisory
http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory
https://wpscan.com/vulnerability/dbe6cf09-971f-42e9-b744-9339454168c7Exploit, Third Party Advisory

Timeline

Published: Jul 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-18945.3A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to speci CVE-2023-18959.6The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint CVE-2023-18977.5Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allo CVE-2023-18987.5Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve d CVE-2023-18997.5Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information b CVE-2023-19005.5A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This could CVE-2023-19018.0The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malic CVE-2023-19028.0The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious CVE-2023-19034.3SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the CVE-2023-19047.5In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Oc CVE-2023-19055.4The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputti CVE-2023-19065.5A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An