Advanced Woo Labels Product Labels Badges For Woocommerce
Monthly
Stored Cross-Site Scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce WordPress plugin (all versions through 2.48) allows authenticated contributors to permanently inject malicious JavaScript via the 'bg_color' parameter into product label definitions. Insufficient input sanitization across multiple rendering functions - confirmed at specific lines in class-awl-label-view.php, awl-functions.php, and class-awl-admin.php - means the payload persists in the database and executes in any visitor's browser on affected product pages. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a fix was committed in WordPress SVN changeset 3627180.
Stored Cross-Site Scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce WordPress plugin (all versions through 2.48) allows authenticated contributors to permanently inject malicious JavaScript via the 'bg_color' parameter into product label definitions. Insufficient input sanitization across multiple rendering functions - confirmed at specific lines in class-awl-label-view.php, awl-functions.php, and class-awl-admin.php - means the payload persists in the database and executes in any visitor's browser on affected product pages. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a fix was committed in WordPress SVN changeset 3627180.