Versions 3.2.1 and earlier are affected by an issue where shortcodes and relative URLs for product downloads are not handled or escaped correctly by the CSV importer, which could potentially result in code injection.
This vulnerability affects the following application versions:
- WooCommerce 3.1.0
- WooCommerce 3.1.1
- WooCommerce 3.1.2
- WooCommerce 3.2.0
- WooCommerce 3.2.0-rc.2
- WooCommerce 3.2.1