CVE-2026-15662
Received Received - Intake

Stored XSS in Advanced Woo Labels WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15662
EUVD
EUVD-2026-51746

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
advanced_woo_labels product_labels_and_badges_for_woocommerce to 2.48 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Advanced Woo Labels plugin for WordPress. It allows authenticated attackers with contributor-level access or higher to inject malicious scripts via the 'bg_color' parameter due to insufficient input sanitization and output escaping. The injected scripts execute when users access the compromised pages.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Advanced Woo Labels plugin for versions up to 2.48. Check for suspicious scripts in the 'bg_color' parameter or injected web scripts in pages. Use WordPress admin access to review plugin versions and scan for unauthorized code changes.

Impact Analysis

This vulnerability can allow attackers to steal user sessions, deface websites, or redirect users to malicious sites. It may also enable phishing attacks or unauthorized actions on behalf of users. The impact depends on the attacker's goals and the site's user base.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing user data or enabling unauthorized access to sensitive information. GDPR requires protecting user data, and HIPAA mandates safeguarding protected health information. A successful XSS attack may violate these regulations.

Mitigation Strategies

Immediately update the Advanced Woo Labels plugin to the latest version beyond 2.48. Remove contributor-level access for untrusted users. Scan WordPress installations for malicious scripts in the 'bg_color' parameter or injected pages. Consider disabling the plugin temporarily if an update is unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart