GHSA-mp46-7x6q-f28m
GitHub Security Advisory
Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
Affected Packages
Packagist
woocommerce/woocommerce
Affected versions:
0
(fixed in 5.2.0)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: September 15, 2025 6:32 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.