CVE-2021-24323

WooCommerce prior to version 5.2.0 contains a stored cross-site scripting vulnerability in the Additional tax classes field when tax functionality is active. The vulnerability stems from inadequate sanitization of user input and insufficient output escaping, allowing authenticated administrators to inject malicious scripts that execute for users viewing affected pages. The flaw only impacts multisite WordPress installations or setups where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).