{"schema":"threatline.record/2","record":{"id":"CVE-2026-12241","aliases":[],"summary":"Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","details":"The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.","categories":["Unclassified"],"product":"Advanced Woo Labels – Product Labels & Badges for WooCommerce","vendor":"mihail-barinov","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-12241","source_modified_at":"2026-10-03T15:42:52.868Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Advanced Woo Labels – Product Labels & Badges for WooCommerce","vendor":"mihail-barinov","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.51","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00201,"percentile":0.09485,"score_date":"2026-10-23"},"published_at":"2026-10-01T04:27:33.782Z","modified_at":"2026-10-03T15:42:52.868Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-12241","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T15:42:52.868Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12241","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08d9118-3615-4f8e-a1cc-ba7e7873b7e5?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/admin/class-awl-admin.php#L121"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/advanced-woo-labels.php#L219"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-label-view.php#L145"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-taxonomy.php#L116"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-taxonomy.php#L78"},{"source":"CVE List","url":"https://kramakit.com/guide/free-version-changelog-awl/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-03T15:31:56.089421Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T15:42:52.868Z","content_hash":"a37210341b34e27bad2b79d378c78ef8a440e4bf86d057f81ff17acbcefe916d"}}