CVE-2025-3814

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>Tax Switch for WooCommerce enhances your WooCommerce store by allowing users to toggle between displaying prices including or excluding VAT. This plugin adds a customizable switch component and provides a flexible way to display both price versions.</p> <h3>Key features</h3> <ul> <li>Display customizable switches where you want</li> <li>Gutenberg block support</li> <li>Shortcode for easy integration (including shortcode generator)</li> <li>Flexible display options for prices with and without VAT</li> <li>Remembers the user&#8217;s preference for future visits</li> <li>Choose between a toggle switch or buttons</li> </ul> <p>For more information about this plugin, please visit the <a href="https://products.wijnberg.dev/product/wordpress/plugins/tax-switch-for-woocommerce/" rel="nofollow ugc">plugin page</a>.</p> <h3>Requirements</h3> <ul> <li>WooCommerce plugin installed and activated</li> <li>WooCommerce tax calculations enabled and configured</li> </ul> <h3>Configuration</h3> <p>Configure the plugin settings below for proper functionality.</p> <h4>WooCommerce settings</h4> <p>Ensure these WooCommerce settings are configured first:</p> <ol> <li> <p><strong>Configure tax calculations</strong></p> <ul> <li>Go to: <em>WooCommerce &gt; Settings &gt; General</em></li> <li>Verify your shop address is complete</li> <li>Enable <em>&#8220;Enable tax rates and calculations&#8221;</em></li> <li>Set <em>&#8220;Default customer location&#8221;</em> to <em>&#8220;Shop base address&#8221;</em></li> </ul> </li> <li> <p><strong>Set up tax rates</strong></p> <ul> <li>Go to: <em>WooCommerce &gt; Settings &gt; Tax &gt; Standard Rates</em></li> <li>Add your regional tax rates</li> </ul> </li> <li> <p><strong>Recommended: tax calculation method</strong></p> <ul> <li>Go to: <em>WooCommerce &gt; Settings &gt; Tax</em></li> <li>Set <em>&#8220;Calculate tax based on&#8221;</em> to <em>&#8220;Shop base address&#8221;</em><br /> <em>(This provides instant tax calculation. Other methods require customers to enter their address first.)</em></li> </ul> </li> <li> <p><strong>Individual product configuration</strong></p> <ul> <li>Edit products at: <em>Products &gt; [Product]</em></li> <li>Under <em>Product Data &gt; Tax</em>, set status to <em>&#8220;Taxable&#8221;</em></li> </ul> </li> </ol> <h4>Plugin settings</h4> <p>Configure these plugin-specific settings:</p> <ol> <li><strong>Main settings</strong> <ul> <li>Go to: <em>WooCommerce &gt; Settings &gt; Tax Switch</em></li> <li>Set your preferred text values</li> <li>Optional: Restrict display locations</li> <li>Optional: Generate a shortcode via <em>WooCommerce &gt; Settings &gt; Tax Switch &gt; Shortcode</em></li> </ul> </li> </ol> <h3>Usage</h3> <p>After installation and configuration, you can add the tax switch to your pages in two ways:</p> <ol> <li>Use the Gutenberg block &#8220;Tax Switch for WooCommerce&#8221; in your page or post editor.</li> <li>Use the shortcode <code>[wdevs_tax_switch]</code> anywhere in your content.</li> </ol> <h4>Shortcode Usage</h4> <p><strong>Switch/buttons</strong></p> <p>Basic usage:<br /> [wdevs_tax_switch]</p> <p>Displays a switch to toggle displaying prices including or excluding VAT.</p> <p>The shortcode accepts several attributes to customize its appearance and behavior:</p> <ul> <li><code>class-name</code>: Adds custom CSS classes to the switch. <ul> <li>Default: is-style-default</li> <li>Options: is-style-default, is-style-inline, is-style-flat-pill, or custom classes</li> </ul> </li> <li><code>switch-type</code>: Determines the style of the toggle. <ul> <li>Default: <code>switch</code></li> <li>Options: <code>switch</code>, <code>buttons</code></li> </ul> </li> <li><code>switch-color</code>: Sets the color of the switch handle.</li> <li><code>switch-color-checked</code>: Sets the color of the switch when it&#8217;s in the &#8220;on&#8221; position.</li> <li><code>switch-background-color</code>: Sets the background color of the switch.</li> <li><code>switch-text-color</code>: Sets the text color of the switch labels.</li> <li><code>switch-background-color-checked</code>: Sets the background color of the switch when it&#8217;s in the &#8220;on&#8221; position.</li> <li><code>switch-label-incl</code>: Sets the text for the &#8220;including VAT&#8221; label. <ul> <li>Default: Uses the text set in the plugin settings or &#8220;Incl. VAT&#8221; if not set.</li> </ul> </li> <li><code>switch-label-excl</code>: Sets the text for the &#8220;excluding VAT&#8221; label. <ul> <li>Default: Uses the text set in the plugin settings or &#8220;Excl. VAT&#8221; if not set.</li> </ul> </li> <li><code>switch-aria-label</code>: Sets the aria label of the switch. <ul> <li>Default: Uses the text set in the plugin settings or &#8220;Switch between prices including and excluding VAT&#8221; if not set.</li> </ul> </li> </ul> <p>Example with custom attributes:</p> <pre><code>[wdevs_tax_switch class-name="is-style-inline" switch-type="switch" switch-color="#ffffff" switch-color-checked="#000000" switch-background-color="#000000" switch-background-color-checked="#4CAF50" switch-text-color="#FF0000" switch-label-incl="Incl. tax" switch-label-excl="Excl. tax" switch-aria-label="Switch between prices including and excluding VAT"] </code></pre> <p><strong>Label</strong></p> <p>Basic usage:<br /> [wdevs_tax_switch_label]</p> <p>Displays text indicating the currently selected tax setting. The text updates automatically when the tax switch is toggled.</p> <p>The shortcode accepts several attributes to customize its appearance and behavior:</p> <ul> <li><code>class-name</code>: Adds custom CSS classes to the label. <ul> <li>Default: is-style-default</li> <li>Options: is-style-default or custom classes</li> </ul> </li> <li><code>label-text-incl</code>: Sets the text to display when &#8220;including VAT&#8221; is selected. <ul> <li>Default: Uses the text set in the plugin settings or &#8220;Incl. VAT&#8221; if not set.</li> </ul> </li> <li><code>label-text-excl</code>: Sets the text to display when &#8220;excluding VAT&#8221; is selected. <ul> <li>Default: Uses the text set in the plugin settings or &#8220;Excl. VAT&#8221; if not set.</li> </ul> </li> <li><code>label-text-color</code>: Sets the &#8220;excluding VAT&#8221; text color.</li> <li><code>label-text-color-checked</code>: Sets the &#8220;including VAT&#8221; text color.</li> </ul> <p>Example with custom attributes:</p> <pre><code>[wdevs_tax_switch_label class-name="tax-indicator" label-text-incl="Prices include tax" label-text-excl="Prices exclude tax" label-text-color="#FF0000" label-text-color-checked="#4CAF50"] </code></pre> <h4>PHP implementation</h4> <p>You can use these shortcodes with PHP with the do_shortcode() function:</p> <pre><code>&lt;?php echo do_shortcode('[wdevs_tax_switch]'); ?&gt; &lt;?php echo do_shortcode('[wdevs_tax_switch_label]'); ?&gt; </code></pre> <h4>JavaScript events</h4> <p>The switch fires a JavaScript event when the tax display is toggled. You can listen for this event to execute custom code when a user switches between inclusive and exclusive VAT display. This is useful for when you need to perform additional actions based on the tax display state.</p> <pre><code>document.addEventListener('wdevs-tax-switch-changed', function(event) { console.log(event.detail); // event.detail contains: // - isSwitched: boolean - the raw switch state // - displayIncludingVat: boolean - whether prices now display including VAT }); </code></pre> <p>If you are loading the switch dynamically (via AJAX), dispatch this event after rendering to initialize the component:</p> <pre><code> document.dispatchEvent( new CustomEvent('wdevs-tax-switch-appeared') ); </code></pre> <h3>WPML</h3> <p>To translate the option texts via WPML:</p> <ol> <li>Save your options first in: WooCommerce -&gt; Settings -&gt; Tax Switch</li> <li>Then translate the texts in: WPML -&gt; String Translations and search for your option values in the domain &#8216;tax-switch-for-woocommerce&#8217;</li> </ol> <h3>Compatibility</h3> <p>This plugin integrates with WooCommerce&#8217;s standard filters and actions for price display and calculation. While most plugins and themes work out of the box, some third-party code use custom price building methods that require specific compatibility integrations.</p> <p>The following themes have been tested and confirmed compatible:</p> <ul> <li>GeneratePress</li> <li>Blocksy</li> <li>Thrive</li> <li>Flatsome</li> <li>Kapee</li> <li>Entr</li> <li>Woodmart</li> <li>Hello Elementor</li> </ul> <p>The following plugins have been tested and confirmed compatible:</p> <ul> <li>WooCommerce Product Table Lite (+ PRO)</li> <li>Tiered Pricing Table for WooCommerce (+ Premium)</li> <li>Measurement Price Calculator for WooCommerce</li> <li>Discount Rules for WooCommerce</li> <li>YITH WooCommerce Product Add-Ons (+ &amp; Extra Options Premium)</li> <li>JetEngine Listing Grid (Elementor)</li> <li>Product Add-Ons for WooCommerce</li> <li>B2BKing – Ultimate WooCommerce Wholesale and B2B Solution (+ Premium)</li> <li>Advanced Product Fields Pro for WooCommerce</li> <li>WooCommerce Quantity Discounts, Rules &amp; Swatches</li> <li>FacetWP</li> <li>Variation Swatches for WooCommerce (+ PRO)</li> <li>Variation Price Display Range for WooCommerce (+ PRO)</li> <li>WooCommerce Product Add-Ons Ultimate</li> <li>Advanced Woo Search (+ PRO)</li> <li>B2B Market</li> <li>FiboFilters</li> <li>Extra Product Options &amp; Add-Ons for WooCommerce</li> <li>FiboSearch – Ajax Search for WooCommerce (+ Pro)</li> <li>YayMail &#8211; WooCommerce Email Customizer</li> <li>PDF Invoices &amp; Packing Slips for WooCommerce</li> <li>WooCommerce Product Bundles</li> <li>LiteSpeed Cache</li> <li>Elementor Pro</li> <li>YITH WooCommerce Role Based Prices</li> <li>WooCommerce Dynamic Pricing and Discount Rules</li> <li>Price Based on Country for WooCommerce</li> <li>WP Grid Builder</li> </ul> <p>If you encounter any compatibility issues with other plugins or themes, please let us know. Your feedback helps us improve the plugin and extend compatibility to more third-party solutions.</p> <h3>Incompatibility</h3> <p>After multiple attempts to create compatibility functions, reaching out to the plugin developers several times, and still finding no viable solution, the following plugins remain incompatible:</p> <ul> <li>Unlimited Elements for Elementor (+ Pro): AJAX pagination and filtering issues</li> <li>Barn2: WooCommerce Product Options</li> </ul> <h3>Additional Information</h3> <p>This plugin is fully open source. You can find the source code on <a href="https://github.com/Paulsky/tax-switch" rel="nofollow ugc">GitHub</a></p> <p>For more information and other WordPress plugins, visit <a href="https://products.wijnberg.dev/product-category/wordpress/plugins/" rel="nofollow ugc">Wijnberg Developments</a>.</p>
WordPress Plugin DirectoryWordPress Plugin Directory
18.2K