This XSS vulnerability was caused because the WooCommerce tax rates setting were incorrectly processing user-supplied data. Remote attackers could trick WooCommerce administrators into uploading a malicious CSV file that claims to provide required tax rate data for a particular country or region. This file injects malicious code into the application, triggering a XSS attack that could allow a remote attacker to gain full control of the web server.
This vulnerability affects the following application versions:
- WooCommerce 2.5.0
- WooCommerce 2.5.0-RC3
- WooCommerce 2.5.1
- WooCommerce 2.5.2
- WooCommerce 2.5.3
- WooCommerce 2.5.4
- WooCommerce 2.5.5
- WooCommerce 2.6.0
- WooCommerce 2.6.0-RC1
- WooCommerce 2.6.0-RC2
- WooCommerce 2.6.1
- WooCommerce 2.6.2
- WooCommerce 2.6.3
- WooCommerce 2.6.4
- WooCommerce 2.6.5
- WooCommerce 2.6.6
- WooCommerce 2.6.7
- WooCommerce 2.6.8