Due to double-escaping, captions could be treated as HTML allowing XSS attacks. However, this would require the admin to upload a malicious image to exploit.
This vulnerability affects the following application versions:
- WooCommerce 2.6.0
- WooCommerce 2.6.0-RC1
- WooCommerce 2.6.0-RC2
- WooCommerce 2.6.1
- WooCommerce 2.6.2