CVE-2016-10112

The WooCommerce plugin prior to version 2.6.9 contains a cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts or HTML code through specially crafted tax rate data submitted in CSV format. An attacker with administrative access could exploit this flaw to execute arbitrary JavaScript or insert HTML content into the WordPress environment. This vulnerability affects all installations running versions earlier than 2.6.9 and is resolved in that release and later.

Based on public CVE data (MITRE/NVD).