Variation download URLs are now cleaned via wc_clean instead of esc_url_raw to prevent XSS vulnerabilities.
This vulnerability affects the following application versions:
- WooCommerce 2.1.0
- WooCommerce 2.1.0-RC1
- WooCommerce 2.1.0-RC2
- WooCommerce 2.1.1