Advanced Woo Labels CVE-2026-12241

Requires an authenticated WordPress account with Contributor-level capabilities or above on a site running the Advanced Woo Labels - Product Labels & Badges for WooCommerce plugin (version ≤2.51), because the 'save_meta_boxes' capability check is improperly secured rather than fully open. The attacker must be able to create an AWL product label, whose content is then rendered without proper escaping. Exploitation is limited by this authentication requirement (not unauthenticated) and by the fact that payload execution occurs only when a victim subsequently views a page rendering the malicious label. Note the plugin was only partially patched in 2.46, so even updated-but-pre-fix installs within the ≤2.51 range remain exposed.

This is a genuine-but-moderate authenticated stored XSS, not a high-urgency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4) shows network-reachable, low-complexity exploitation that nonetheless requires authenticated access at Contributor level or above (PR:L), which is the main gating factor - an attacker needs a valid low-privilege account on the WooCommerce store. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence; exploitation status is therefore 'no public exploit identified at time of analysis.' One notable conflict in the data: the vendor assigned S:U (scope unchanged), yet this is a stored XSS whose payload executes in the browsers of other users (store visitors and administrators who view the rendered labels), which typically warrants S:C and a score closer to 6.4 - this makes the official 5.4 arguably conservative. A second important signal: the description states the flaw was only 'partially patched in version 2.46' yet remains present in all versions 'up to, and including, 2.51,' meaning no fully-fixed release is confirmed in the provided data - defenders cannot simply 'update to patched version.' Net: real but bounded risk, limited by the Contributor+ authentication requirement.

An attacker who holds or obtains a Contributor-level (or higher) account on a WooCommerce store calls the improperly-protected 'save_meta_boxes' function to create an Advanced Woo Labels product label containing a malicious script. Because the label content is rendered without proper output escaping, the stored script executes in the browser of anyone who views the affected product/store page - including shop visitors and administrators in the wp-admin context. No public exploit code was identified, and exploitation requires a valid authenticated low-privilege account.