UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2021-24323

WooCommerce: Cross-site Scripting

Severity
Medium 4.8
Published
21 Apr 2021
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.2.0
Also known as
WPV-58a723f73406
Sources
NVD, WPVulnerability

Description

When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled

Affected software

SoftwareAffected versions
WooCommerceServers and applications · cpe:a:woocommerce:woocommerce
  • Every version before 5.2.0
WooCommerceWordPress plugins · wp-plugin:woocommerce
  • Every version before 5.2.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-24323
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-24323
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce/woocommerce-513-authenticated-admin-stored-cross-site-scripting