Lucene search
WPScanCVELIST:CVE-2023-0893HistoryApr 10, 2023 - 1:17 p.m.
CVE-2023-0893 Time Sheets < 1.29.3 - Admin+ Stored XSS
2023-04-1013:17:53
WPScan
www.cve.org
1
cve-2023-0893
time sheets
wordpress
stored xss
settings
high privilege users
admin
unfiltered_html
capability
multisite setup
EPSS
0.001
Percentile
23.5%
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CNA Affected
[
{
"vendor": "Unknown",
"product": "Time Sheets",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "1.29.3"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
cve
cve
CVE-2023-0893
2023-04-10 14:15:08
wpvulndb
wpvulndb
Time Sheets < 1.29.3 - Admin+ Stored XSS
2023-03-20 00:00:00
nvd
nvd
CVE-2023-0893
2023-04-10 14:15:08
prion
prion
Cross site scripting
2023-04-10 14:15:00
wpexploit
wpexploit
Time Sheets < 1.29.3 - Admin+ Stored XSS
2023-03-20 00:00:00
wordfence
wordfence