The Label Plugins plugin for WordPress contains a missing nonce validation in the label_plugins_options() function, which allows attackers to forge a request that updates plugin settings and injects malicious scripts. The injected scripts are stored and executed in the context of site administrators or other users, enabling theft of credentials, defacement, or other compromised user actions. This flaw is a Cross‑Site Request Forgery that leads to Stored Cross‑Site Scripting and is classified as CWE‑352.

The only affected vendor/product is theode:Label Plugins for versions up to and including 0.5. No other versions are listed, and no additional affected products are identified in the data.

The CVSS score of 6.1 indicates a medium severity risk, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The attack likely requires a site administrator to be tricked into clicking a crafted link or link in an email, after which the forged request runs with the administrator's privileges to store the malicious script. Because the vulnerability is exploitable without authentication but depends on user interaction, the overall risk is moderate with a low exploitation likelihood.