What is the CVSS score of CVE-2026-15662?

CVE-2026-15662 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Advanced Woo Labels CVE-2026-15662

EUVD-2026-51746 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-01 Wordfence

GHSA-p5xx-cr4j-pcxv

WordPress XSS Wordpress Plugin Advanced Woo Labels Product Labels Badges For Woocommerce

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Contributor authentication required (PR:L); victim must browse to the infected product page to trigger the stored payload (UI:R); browser scope change applies (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:59 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Advanced Woo Labels - Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce WordPress plugin (all versions through 2.48) allows authenticated contributors to permanently inject malicious JavaScript via the 'bg_color' parameter into product label definitions. Insufficient input sanitization across multiple rendering functions - confirmed at specific lines in class-awl-label-view.php, awl-functions.php, and class-awl-admin.php - means the payload persists in the database and executes in any visitor's browser on affected product pages. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a fix was committed in WordPress SVN changeset 3627180.

Technical ContextAI

The plugin (CPE: cpe:2.3:a:mihail-barinov:advanced_woo_labels_-_product_labels_&_badges_for_woocommerce:*:*:*:*:*:*:*:*) extends WooCommerce by rendering configurable product badge overlays, including inline CSS color values supplied by contributors. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the bg_color value is stored in the database without sanitization and later emitted into HTML/CSS output without escaping. Wordfence identified at least six distinct vulnerable output points across class-awl-label-view.php (lines 332, 434, 449, 560), class-awl-admin.php (line 123), and awl-functions.php (line 93). The CVSS scope-change flag (S:C) reflects that the injected script executes in the victim's browser context - a different security boundary from the WordPress server - enabling cross-context impact such as session token exfiltration or DOM manipulation.

RemediationAI

Update the Advanced Woo Labels plugin to a version newer than 2.48. A fix was committed to the WordPress plugin SVN in changeset 3627180 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3627180%40advanced-woo-labels&new=3627180%40advanced-woo-labels); however, the exact patched release version number is not independently confirmed from the available data - verify the current available version in the WordPress plugin repository before updating. As an interim workaround, restrict contributor-level role assignments on any WordPress installation running this plugin, ensuring only trusted users hold contributor or higher roles; this eliminates the attack surface but may disrupt publishing workflows. Alternatively, temporarily deactivating the plugin prevents exploitation with no data loss, at the cost of losing product label display functionality. Implementing a web application firewall rule to block script-like content in CSS color parameters (e.g., targeting requests containing bg_color values with parentheses or script keywords) is a partial compensating control but may produce false positives.