CVE-2021-24323: Woocommerce

Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days.

When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled

Affected products

• Woocommerce Woocommerce: before 5.2.0 (fixed in 5.2.0)

Published 2021-05-17. Last modified 2026-06-17.