CVE-2023-0942

MEDIUMNuclei

Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-0942 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 13, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Japanized for WooCommerce

Browse shoheitanaka / Japanized for WooCommerce

Default status: unaffected

CVE ListThrough 2.5.4affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Japanized for WooCommerce <2.5.5 - Cross-Site ScriptingCVSS 6.1

WordPress Japanized for WooCommerce plugin before 2.5.5 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Fixed in version 2.5.5.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvewoocommerce-for-japanwpwpscanwordpressauthenticatedxsswoocommercepluginartisanworkshopvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:artisanworkshop:japanized_for_woocommerce:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/71aa9460-6dea-49cc-946c-d7d4bf723511 https://wordpress.org/plugins/woocommerce-for-japan/ https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/admin/views/html-admin-setting-screen.php#L63 https://nvd.nist.gov/vuln/detail/CVE-2023-0942 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2868545%40woocommerce-for-japan%2Ftrunk&old=2863064%40woocommerce-for-japan%2Ftrunk&sfp_email=&sfph_mail=

Source: ProjectDiscovery

References

6