Skip to content
Sign in
6.4 Medium

CVE-2026-15662 The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored…

Description

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product Affected versions Fixed in
Advanced Woo Labels – Product Labels & Badges for WooCommerce 2.48 earliest → 2.48 No fix stated

Other CVEs of Advanced Woo Labels – Product Labels & Badges for WooCommerce

The 3 CVEs of Advanced Woo Labels – Product Labels & Badges for WooCommerce →
CVE-2026-12241 The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized… 5.4 Medium CVE-2026-1929 The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and… 8.8 High
Track this CVE