WordPress Plugin Vulnerabilities

Advanced Woo Labels < 2.16 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
advanced-woo-labels
Fixed in 2.16

References

CVE
CVE-2025-32188
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/03fa3a62-c5b7-4772-b8fe-26ae476b4ae4

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
SavPhill (Savphill)
Verified
No
WPVDB ID
0571f479-cff7-43bd-9b78-13d5592deead

Timeline

Publicly Published
2025-04-04 (about 1 year ago)
Added
2025-04-08 (about 1 year ago)
Last Updated
2025-04-11 (about 1 year ago)

Other

Published
Title
Published
2025-09-08
Title
WC Return products <= 1.5 - Reflected Cross-Site Scripting
Published
2023-09-08
Title
Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries
Published
2024-09-30
Title
Advanced Woo Labels < 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-11
Title
Feedpress Generator <= 1.2.1 - Reflected Cross-Site Scripting
Published
2024-11-22
Title
Twitter Follow Button < 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter