Advanced Woo Labels Vulnerabilities

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 2.48

Fixed in:

2.49

Disclosed:

Jul 31, 2026

CVE-2026-15662 on NVD →

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.36. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

CVSS:

7.2

Affected:

up to 2.36

Fixed in:

2.37

Disclosed:

Feb 25, 2026

CVE-2026-32414 on NVD →

The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.37. This is due to the use of `call_user_func_array()` with user-controlled callback and parameters in the `get_select_option_values()` AJAX handler without an allowlist of permitted callbacks or...

CVSS:

8.8

Affected:

up to 2.36

Fixed in:

2.37

Disclosed:

Feb 24, 2026

CVE-2026-1929 on NVD →

The Advanced Woo Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 2.15

Fixed in:

2.16

Disclosed:

Apr 4, 2025

CVE-2025-32188 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Stored XSS. This issue affects Advanced Woo Labels: from n/a through 2.14.

Affected:

up to 2.16

Fixed in:

2.16

Disclosed:

Apr 4, 2025

CVE-2025-32188 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Stored XSS.This issue affects Advanced Woo Labels: from n/a through 2.01.

Affected:

up to 2.02

Fixed in:

2.02

Disclosed:

Oct 5, 2024

CVE-2024-47622 on NVD →

The Advanced Woo Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.01 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 2.01

Fixed in:

2.02

Disclosed:

Sep 30, 2024

CVE-2024-47622 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Cross-Site Scripting (XSS).This issue affects Advanced Woo Labels: from n/a through 1.93.

Affected:

up to 1.94

Fixed in:

1.94

Disclosed:

Jun 8, 2024

CVE-2024-35675 on NVD →

The Advanced Woo Labels – Product Labels for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut...

CVSS:

6.4

Affected:

up to 1.93

Fixed in:

1.94

Disclosed:

Jun 5, 2024

CVE-2024-35675 on NVD →