CVE-2026-12241: Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'savemetaboxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated user with Contributor-level access or higher can exploit the issue. Subscriber-only access is not identified as sufficient in the description.
What must an attacker be able to do?
The attacker needs an authenticated WordPress account with at least Contributor privileges and must be able to create AWS labels containing script content. The malicious label is then rendered without proper escaping, resulting in stored cross-site scripting.
Are installations running version 2.46 or later safe?
No. The issue affects all versions through 2.51, and version 2.46 only partially patched it.
How can I determine whether my site is affected?
Check whether Advanced Woo Labels is installed and whether its version is 2.51 or earlier. Also review AWS labels created by Contributor-level or higher accounts for unexpected HTML or script content.