WooCommerce Tax (formerly WooCommerce Shipping & Tax)

WooCommerce Tax (formerly WooCommerce Shipping & Tax) has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 5.5 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for WooCommerce Tax (formerly WooCommerce Shipping & Tax) has a vendor fix available, so running the current release closes it.

WooCommerce Tax (formerly WooCommerce Shipping & Tax) is installed on roughly 500,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all WooCommerce Tax (formerly WooCommerce Shipping & Tax) vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.5

WooCommerce Shipping & Tax <= 2.2.4 - Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
WooCommerce Tax (formerly WooCommerce Shipping & Tax) banner
Latestv3.6.15

WooCommerce Tax (formerly WooCommerce Shipping & Tax)

WooCommerce

Author

WooCommerce

2.0(105)
40/100
Last Updated
2026-09-07 (6d ago)
Active Installs
500,000+
Downloads
52,727,964
Requires WP
7.0+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2017-01-28 (10y ago)
Requires Plugins
woocommerce

Attention: Shipping features have moved to a new dedicated plugin. Download WooCommerce Shipping. Enable automated taxes That’s it! Once you update your tax settings, your store will collect sales tax at checkout based on the store address in your WooCommerce Settings. Eliminate the need to even think about sales taxes for your store Automatically calculate how much sales tax should be collected for WooCommerce orders — by city, country, or state — at checkout. External services This plugin relies on the following external services: WordPress.com connection: Description: The plugin makes requests to our own endpoints at WordPress.com (proxied via https://api.woocommerce.com) to fetch automated tax calculations. Website: https://wordpress.com/ Terms of Service: https://wordpress.com/tos/ Privacy Policy: https://automattic.com/privacy/ Usage Tracking: Description: The plugin will send usage statistics to our own service, after the user has accepted our Terms of Service. Script: https://stats.wp.com/w.js Terms of Service: https://wordpress.com/tos/ Privacy Policy: https://automattic.com/privacy/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C