CVE-2023-0948

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-09494.8Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.CVE-2023-09507.8Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to cCVE-2023-09518.8Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perforCVE-2023-09526.5Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive dataCVE-2023-09538.8Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker toCVE-2023-09549.8A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long periCVE-2023-09558.8The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection aCVE-2023-09567.5External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizingCVE-2023-09579.6An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability thCVE-2023-09586.5Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handCVE-2023-09596.5Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link senCVE-2023-09609.8A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /da
CVE-2023-0948: Medium severity, CVSS 6.1 | Vulnix