WooCommerce Tax (formerly WooCommerce Shipping & Tax)
WooCommerce Tax (formerly WooCommerce Shipping & Tax) has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 5.5 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for WooCommerce Tax (formerly WooCommerce Shipping & Tax) has a vendor fix available, so running the current release closes it.
WooCommerce Tax (formerly WooCommerce Shipping & Tax) is installed on roughly 500,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
WooCommerce Shipping & Tax <= 2.2.4 - Stored Cross-Site Scripting
Read the full analysisVulnerability Records

WooCommerce Tax (formerly WooCommerce Shipping & Tax)
Author
WooCommerce
woocommerceAttention: Shipping features have moved to a new dedicated plugin. Download WooCommerce Shipping. Enable automated taxes That’s it! Once you update your tax settings, your store will collect sales tax at checkout based on the store address in your WooCommerce Settings. Eliminate the need to even think about sales taxes for your store Automatically calculate how much sales tax should be collected for WooCommerce orders — by city, country, or state — at checkout. External services This plugin relies on the following external services: WordPress.com connection: Description: The plugin makes requests to our own endpoints at WordPress.com (proxied via https://api.woocommerce.com) to fetch automated tax calculations. Website: https://wordpress.com/ Terms of Service: https://wordpress.com/tos/ Privacy Policy: https://automattic.com/privacy/ Usage Tracking: Description: The plugin will send usage statistics to our own service, after the user has accepted our Terms of Service. Script: https://stats.wp.com/w.js Terms of Service: https://wordpress.com/tos/ Privacy Policy: https://automattic.com/privacy/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C