Medium severity · published May 17, 2021
CVE-2021-24323
Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WooCommerce · Automattic
5.2.0 before 5.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24323
Exploit
https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010
More from WooCommerce
8.8
CVE-2023-52222
WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
7.6
CVE-2026-57777
WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability
7.5
CVE-2026-48888
WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
7.5
CVE-2026-3589
WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
7.5
CVE-2017-17058
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent…