VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 6 known issues Latest disclosed Feb 26, 2026

Japanized for WooCommerce Vulnerabilities

Review known vulnerability records for the WordPress plugin Japanized for WooCommerce (`woocommerce-for-japan`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-1305, CVE-2025-14886 and CVE-2025-48284, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
6
High or Critical
0
Patch Coverage
100%
Last Updated
Feb 27, 2026
Priority CVE Quick Links

Fast paths into Japanized for WooCommerce CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
6
CVE-2023-47698 Medium 2.6.5
CVE-2023-47698 Japanized for WooCommerce Vulnerability

Japanized For WooCommerce <= 2.6.4 - Missing Authorization

CVE-2023-0948 Medium 2.5.7
CVE-2023-0948 Japanized for WooCommerce Cross-Site Scripting

Japanized For WooCommerce <= 2.5.6 - Reflected Cross-Site Scripting

CVE-2023-0942 Medium 2.5.5
CVE-2023-0942 Japanized for WooCommerce Cross-Site Scripting

Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting

CVE-2026-1305 Medium 2.8.5
CVE-2026-1305 Japanized for WooCommerce Vulnerability

Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation

CVE-2025-14886 Medium 2.8.0
CVE-2025-14886 Japanized for WooCommerce Vulnerability

Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification

CVE-2025-48284 Medium 2.6.41
CVE-2025-48284 Japanized for WooCommerce Cross-Site Request Forgery

Japanized For WooCommerce <= 2.6.40 - Cross-Site Request Forgery

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Japanized for WooCommerce so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
6 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 0 high severity findings.
Recent CVEs
CVE-2026-1305, CVE-2025-14886 and CVE-2025-48284
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Japanized for WooCommerce

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-1305
CVE-2026-1305: Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook sign...

Published
Feb 26, 2026
Patched Release
2.8.5
Affected Versions
Versions up to 2.8.4
Next Step
Update to 2.8.5 or newer if supported.
Open CVE-2026-1305 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-14886
CVE-2025-14886: Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification

The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any...

Published
Jan 08, 2026
Patched Release
2.8.0
Affected Versions
Versions up to 2.7.17
Next Step
Update to 2.8.0 or newer if supported.
Open CVE-2025-14886 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-48284
CVE-2025-48284: Japanized For WooCommerce <= 2.6.40 - Cross-Site Request Forgery

The Japanized for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.40. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the plug...

Published
May 19, 2025
Patched Release
2.6.41
Affected Versions
Versions up to 2.6.40
Next Step
Update to 2.6.41 or newer if supported.
Open CVE-2025-48284 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-47698
CVE-2023-47698: Japanized For WooCommerce <= 2.6.4 - Missing Authorization

The Japanized For WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification due to missing capability checks on several functions called via REST API function in versions up to, and including, 2.6.4. This makes it possible for unauthenticated attacker...

Published
Nov 09, 2023
Patched Release
2.6.5
Affected Versions
Versions up to 2.6.4
Next Step
Update to 2.6.5 or newer if supported.
Open CVE-2023-47698 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-0948
CVE-2023-0948: Japanized For WooCommerce <= 2.5.6 - Reflected Cross-Site Scripting

The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via unescaped URLs in versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Published
Apr 17, 2023
Patched Release
2.5.7
Affected Versions
Versions up to 2.5.6
Next Step
Update to 2.5.7 or newer if supported.
Open CVE-2023-0948 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-0942
CVE-2023-0942: Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting

The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...

Published
Feb 21, 2023
Patched Release
2.5.5
Affected Versions
Versions up to 2.5.4
Next Step
Update to 2.5.5 or newer if supported.
Open CVE-2023-0942 Report Open CVE Reference