CVE-2023-0942mediumCWE-79

CVE-2023-0942: fallo de gravedad media en shoheitanaka Japanized for WooCommerce

Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting

Publicada el · Actualizada el

28Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 6.1epss 1.2%
probabilidad de explotación
1.2%top 32% de las CVE
explotación observada
noninguna fuente lo reporta
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
shoheitanaka · Japanized for WooCommerce
CVEs relacionadas — shoheitanaka Japanized for WooCommerce

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-1305MEDIUMJapanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order ManipulationEPSS 0.4%CVE-2025-14886MEDIUMJapanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status ModificationEPSS 0.3%
Referencias
https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/admin/views/html-admin-setting-screen.php#L63https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2868545%40woocommerce-for-japan%2Ftrunk&old=2863064%40woocommerce-for-japan%2Ftrunk&sfp_email=&sfph_mail=https://www.wordfence.com/blog/2023/03/multiple-reflected-cross-site-scripting-vulnerabilities-in-three-wordpress-plugins-patched/https://www.wordfence.com/threat-intel/vulnerabilities/id/bb606a30-2f7c-41e9-9ebc-9f1b0b84fff8https://www.wordfence.com/threat-intel/vulnerabilities/id/bb606a30-2f7c-41e9-9ebc-9f1b0b84fff8?source=cve