CVE-2023-0942

Deeper analysis

The Japanized For WooCommerce plugin for WordPress is affected by a reflected cross-site scripting vulnerability in versions up to and including 2.5.4. The flaw exists in the handling of the tab parameter within the administrative settings screen and stems from insufficient input sanitization combined with inadequate output escaping, allowing script injection into rendered pages.

Unauthenticated attackers can exploit the issue by crafting malicious links that, when clicked by an authenticated user, cause arbitrary web scripts to execute in the victim's browser context with the plugin's privileges. The attack requires user interaction such as following a supplied URL and results in limited impacts to confidentiality and integrity without affecting availability.

Public references including Wordfence advisories and WordPress plugin repository changesets indicate that the vulnerability was addressed through updated code in later releases of the plugin, with the fix focusing on proper escaping of the tab parameter.

The associated EPSS score rose from lower values after disclosure to a peak of 0.4614 before receding to the current level of 0.2461, indicating that exploitation interest emerged post-publication.