CVE-2023-0942 in Japanized for WooCommerce plugin
Summary
by MITRE • 02/21/2023
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/09/2026
The CVE-2023-0942 vulnerability affects the Japanized For WooCommerce WordPress plugin, specifically versions up to and including 2.5.4, presenting a critical reflected cross-site scripting flaw that compromises user security. This vulnerability exists within the plugin's handling of the 'tab' parameter, which is commonly used for navigation within the plugin's administrative interface. The flaw arises from inadequate input sanitization and insufficient output escaping mechanisms that fail to properly validate or encode user-supplied data before it is rendered in web pages. The vulnerability is classified under CWE-79 as a failure to sanitize or escape output, which directly enables malicious actors to inject arbitrary JavaScript code into web pages viewed by unsuspecting users.
The operational impact of this vulnerability extends beyond simple script injection, as it enables attackers to perform various malicious activities through social engineering techniques that trick users into clicking on compromised links. An unauthenticated attacker can craft malicious URLs containing script payloads in the 'tab' parameter, which when clicked by a victim, executes in the victim's browser context. This creates a persistent threat vector that can be leveraged for session hijacking, credential theft, defacement of the affected website, or redirection to malicious sites. The reflected nature of the vulnerability means that the injected script is reflected off the web server and delivered to the victim, making it particularly dangerous as it can bypass many traditional security measures that rely on static content analysis.
Security practitioners should consider this vulnerability in the context of the ATT&CK framework under the T1566 technique for social engineering, where attackers manipulate users into executing malicious code through deceptive links. The vulnerability's exploitation requires minimal privileges and can affect any user who visits a maliciously crafted URL, making it particularly dangerous in environments where administrators frequently click on links or where the plugin is widely used. Organizations using this plugin should prioritize immediate remediation through version updates, as the vulnerability exists in all versions up to 2.5.4 and represents a significant risk to website integrity and user data security. The vulnerability highlights the critical importance of input validation and output escaping in web applications, particularly in plugins that handle user data or administrative functions, as these components often become primary targets for attackers seeking to compromise WordPress installations.