CVE-2026-12241
Received Received - Intake

Unauthorized Data Modification in Advanced Woo Labels WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Wordfence

Description
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-12241
EUVD
EUVD-2026-90478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woothemes advanced_woo_labels to 2.51 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Advanced Woo Labels plugin for WordPress. It allows authenticated attackers with Contributor-level access or higher to create AWS labels without proper escaping due to an improper capability check in the 'save_meta_boxes' function. This could lead to unauthorized data modification.

Impact Analysis

If you use the Advanced Woo Labels plugin, attackers could exploit this to modify data or inject malicious content like scripts. This may disrupt your WooCommerce store or expose users to security risks such as cross-site scripting (XSS).

Compliance Impact

This vulnerability could lead to unauthorized data modifications or exposure, potentially violating GDPR (data integrity) or HIPAA (protected health information). Compliance may be impacted if user data is compromised or altered without authorization.

Mitigation Strategies

Update the Advanced Woo Labels plugin to the latest version, as partial patches were introduced in version 2.46 and later versions may include further fixes. Remove Contributor-level and higher access for users who do not need it to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart