CVE-2026-12241

MediumCVSS 5.4

Published: 01/10/2026(UTC)Updated: 03/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Advanced Woo Labels plugin for WordPress is vulnerable to unauthorized data modification due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to and including 2.51. This allows authenticated attackers with Contributor-level access and above to create AWS labels rendered without proper escaping. The vulnerability was partially patched in version 2.46.

Risk Assessment

Unauthorized data modification and lack of escaping can lead to script injection (XSS) and content integrity issues.

Recommendation

Update the plugin to the latest fully patched version and restrict Contributor role permissions.

Other vulnerabilities in Advanced Woo Labels

CVE-2026-15662Medium
The Advanced Woo Labels plugin for WordPress is vulnerable to stored XSS via the 'bg_color' parameter. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.

Original NVD description (English source)

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS