CVE-2025-3814
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>Tax Switch for WooCommerce enhances your WooCommerce store by allowing users to toggle between displaying prices including or excluding VAT. This plugin adds a customizable switch component and provides a flexible way to display both price versions.</p>
<h3>Key features</h3>
<ul>
<li>Display customizable switches where you want</li>
<li>Gutenberg block support</li>
<li>Shortcode for easy integration (including shortcode generator)</li>
<li>Flexible display options for prices with and without VAT</li>
<li>Remembers the user’s preference for future visits</li>
<li>Choose between a toggle switch or buttons</li>
</ul>
<p>For more information about this plugin, please visit the <a href="https://products.wijnberg.dev/product/wordpress/plugins/tax-switch-for-woocommerce/" rel="nofollow ugc">plugin page</a>.</p>
<h3>Requirements</h3>
<ul>
<li>WooCommerce plugin installed and activated</li>
<li>WooCommerce tax calculations enabled and configured</li>
</ul>
<h3>Configuration</h3>
<p>Configure the plugin settings below for proper functionality.</p>
<h4>WooCommerce settings</h4>
<p>Ensure these WooCommerce settings are configured first:</p>
<ol>
<li>
<p><strong>Configure tax calculations</strong></p>
<ul>
<li>Go to: <em>WooCommerce > Settings > General</em></li>
<li>Verify your shop address is complete</li>
<li>Enable <em>“Enable tax rates and calculations”</em></li>
<li>Set <em>“Default customer location”</em> to <em>“Shop base address”</em></li>
</ul>
</li>
<li>
<p><strong>Set up tax rates</strong></p>
<ul>
<li>Go to: <em>WooCommerce > Settings > Tax > Standard Rates</em></li>
<li>Add your regional tax rates</li>
</ul>
</li>
<li>
<p><strong>Recommended: tax calculation method</strong></p>
<ul>
<li>Go to: <em>WooCommerce > Settings > Tax</em></li>
<li>Set <em>“Calculate tax based on”</em> to <em>“Shop base address”</em><br />
<em>(This provides instant tax calculation. Other methods require customers to enter their address first.)</em></li>
</ul>
</li>
<li>
<p><strong>Individual product configuration</strong></p>
<ul>
<li>Edit products at: <em>Products > [Product]</em></li>
<li>Under <em>Product Data > Tax</em>, set status to <em>“Taxable”</em></li>
</ul>
</li>
</ol>
<h4>Plugin settings</h4>
<p>Configure these plugin-specific settings:</p>
<ol>
<li><strong>Main settings</strong>
<ul>
<li>Go to: <em>WooCommerce > Settings > Tax Switch</em></li>
<li>Set your preferred text values</li>
<li>Optional: Restrict display locations</li>
<li>Optional: Generate a shortcode via <em>WooCommerce > Settings > Tax Switch > Shortcode</em></li>
</ul>
</li>
</ol>
<h3>Usage</h3>
<p>After installation and configuration, you can add the tax switch to your pages in two ways:</p>
<ol>
<li>Use the Gutenberg block “Tax Switch for WooCommerce” in your page or post editor.</li>
<li>Use the shortcode <code>[wdevs_tax_switch]</code> anywhere in your content.</li>
</ol>
<h4>Shortcode Usage</h4>
<p><strong>Switch/buttons</strong></p>
<p>Basic usage:<br />
[wdevs_tax_switch]</p>
<p>Displays a switch to toggle displaying prices including or excluding VAT.</p>
<p>The shortcode accepts several attributes to customize its appearance and behavior:</p>
<ul>
<li><code>class-name</code>: Adds custom CSS classes to the switch.
<ul>
<li>Default: is-style-default</li>
<li>Options: is-style-default, is-style-inline, is-style-flat-pill, or custom classes</li>
</ul>
</li>
<li><code>switch-type</code>: Determines the style of the toggle.
<ul>
<li>Default: <code>switch</code></li>
<li>Options: <code>switch</code>, <code>buttons</code></li>
</ul>
</li>
<li><code>switch-color</code>: Sets the color of the switch handle.</li>
<li><code>switch-color-checked</code>: Sets the color of the switch when it’s in the “on” position.</li>
<li><code>switch-background-color</code>: Sets the background color of the switch.</li>
<li><code>switch-text-color</code>: Sets the text color of the switch labels.</li>
<li><code>switch-background-color-checked</code>: Sets the background color of the switch when it’s in the “on” position.</li>
<li><code>switch-label-incl</code>: Sets the text for the “including VAT” label.
<ul>
<li>Default: Uses the text set in the plugin settings or “Incl. VAT” if not set.</li>
</ul>
</li>
<li><code>switch-label-excl</code>: Sets the text for the “excluding VAT” label.
<ul>
<li>Default: Uses the text set in the plugin settings or “Excl. VAT” if not set.</li>
</ul>
</li>
<li><code>switch-aria-label</code>: Sets the aria label of the switch.
<ul>
<li>Default: Uses the text set in the plugin settings or “Switch between prices including and excluding VAT” if not set.</li>
</ul>
</li>
</ul>
<p>Example with custom attributes:</p>
<pre><code>[wdevs_tax_switch class-name="is-style-inline" switch-type="switch" switch-color="#ffffff" switch-color-checked="#000000" switch-background-color="#000000" switch-background-color-checked="#4CAF50" switch-text-color="#FF0000" switch-label-incl="Incl. tax" switch-label-excl="Excl. tax" switch-aria-label="Switch between prices including and excluding VAT"]
</code></pre>
<p><strong>Label</strong></p>
<p>Basic usage:<br />
[wdevs_tax_switch_label]</p>
<p>Displays text indicating the currently selected tax setting. The text updates automatically when the tax switch is toggled.</p>
<p>The shortcode accepts several attributes to customize its appearance and behavior:</p>
<ul>
<li><code>class-name</code>: Adds custom CSS classes to the label.
<ul>
<li>Default: is-style-default</li>
<li>Options: is-style-default or custom classes</li>
</ul>
</li>
<li><code>label-text-incl</code>: Sets the text to display when “including VAT” is selected.
<ul>
<li>Default: Uses the text set in the plugin settings or “Incl. VAT” if not set.</li>
</ul>
</li>
<li><code>label-text-excl</code>: Sets the text to display when “excluding VAT” is selected.
<ul>
<li>Default: Uses the text set in the plugin settings or “Excl. VAT” if not set.</li>
</ul>
</li>
<li><code>label-text-color</code>: Sets the “excluding VAT” text color.</li>
<li><code>label-text-color-checked</code>: Sets the “including VAT” text color.</li>
</ul>
<p>Example with custom attributes:</p>
<pre><code>[wdevs_tax_switch_label class-name="tax-indicator" label-text-incl="Prices include tax" label-text-excl="Prices exclude tax" label-text-color="#FF0000" label-text-color-checked="#4CAF50"]
</code></pre>
<h4>PHP implementation</h4>
<p>You can use these shortcodes with PHP with the do_shortcode() function:</p>
<pre><code><?php echo do_shortcode('[wdevs_tax_switch]'); ?>
<?php echo do_shortcode('[wdevs_tax_switch_label]'); ?>
</code></pre>
<h4>JavaScript events</h4>
<p>The switch fires a JavaScript event when the tax display is toggled. You can listen for this event to execute custom code when a user switches between inclusive and exclusive VAT display. This is useful for when you need to perform additional actions based on the tax display state.</p>
<pre><code>document.addEventListener('wdevs-tax-switch-changed', function(event) {
console.log(event.detail);
// event.detail contains:
// - isSwitched: boolean - the raw switch state
// - displayIncludingVat: boolean - whether prices now display including VAT
});
</code></pre>
<p>If you are loading the switch dynamically (via AJAX), dispatch this event after rendering to initialize the component:</p>
<pre><code> document.dispatchEvent( new CustomEvent('wdevs-tax-switch-appeared') );
</code></pre>
<h3>WPML</h3>
<p>To translate the option texts via WPML:</p>
<ol>
<li>Save your options first in: WooCommerce -> Settings -> Tax Switch</li>
<li>Then translate the texts in: WPML -> String Translations and search for your option values in the domain ‘tax-switch-for-woocommerce’</li>
</ol>
<h3>Compatibility</h3>
<p>This plugin integrates with WooCommerce’s standard filters and actions for price display and calculation. While most plugins and themes work out of the box, some third-party code use custom price building methods that require specific compatibility integrations.</p>
<p>The following themes have been tested and confirmed compatible:</p>
<ul>
<li>GeneratePress</li>
<li>Blocksy</li>
<li>Thrive</li>
<li>Flatsome</li>
<li>Kapee</li>
<li>Entr</li>
<li>Woodmart</li>
<li>Hello Elementor</li>
</ul>
<p>The following plugins have been tested and confirmed compatible:</p>
<ul>
<li>WooCommerce Product Table Lite (+ PRO)</li>
<li>Tiered Pricing Table for WooCommerce (+ Premium)</li>
<li>Measurement Price Calculator for WooCommerce</li>
<li>Discount Rules for WooCommerce</li>
<li>YITH WooCommerce Product Add-Ons (+ & Extra Options Premium)</li>
<li>JetEngine Listing Grid (Elementor)</li>
<li>Product Add-Ons for WooCommerce</li>
<li>B2BKing – Ultimate WooCommerce Wholesale and B2B Solution (+ Premium)</li>
<li>Advanced Product Fields Pro for WooCommerce</li>
<li>WooCommerce Quantity Discounts, Rules & Swatches</li>
<li>FacetWP</li>
<li>Variation Swatches for WooCommerce (+ PRO)</li>
<li>Variation Price Display Range for WooCommerce (+ PRO)</li>
<li>WooCommerce Product Add-Ons Ultimate</li>
<li>Advanced Woo Search (+ PRO)</li>
<li>B2B Market</li>
<li>FiboFilters</li>
<li>Extra Product Options & Add-Ons for WooCommerce</li>
<li>FiboSearch – Ajax Search for WooCommerce (+ Pro)</li>
<li>YayMail – WooCommerce Email Customizer</li>
<li>PDF Invoices & Packing Slips for WooCommerce</li>
<li>WooCommerce Product Bundles</li>
<li>LiteSpeed Cache</li>
<li>Elementor Pro</li>
<li>YITH WooCommerce Role Based Prices</li>
<li>WooCommerce Dynamic Pricing and Discount Rules</li>
<li>Price Based on Country for WooCommerce</li>
<li>WP Grid Builder</li>
</ul>
<p>If you encounter any compatibility issues with other plugins or themes, please let us know. Your feedback helps us improve the plugin and extend compatibility to more third-party solutions.</p>
<h3>Incompatibility</h3>
<p>After multiple attempts to create compatibility functions, reaching out to the plugin developers several times, and still finding no viable solution, the following plugins remain incompatible:</p>
<ul>
<li>Unlimited Elements for Elementor (+ Pro): AJAX pagination and filtering issues</li>
<li>Barn2: WooCommerce Product Options</li>
</ul>
<h3>Additional Information</h3>
<p>This plugin is fully open source. You can find the source code on <a href="https://github.com/Paulsky/tax-switch" rel="nofollow ugc">GitHub</a></p>
<p>For more information and other WordPress plugins, visit <a href="https://products.wijnberg.dev/product-category/wordpress/plugins/" rel="nofollow ugc">Wijnberg Developments</a>.</p>