The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.