The Advanced Woo Labels plugin for WooCommerce contains an improper capability check that allows authenticated users with Contributor or higher access to create labels that are rendered without proper escaping. This flaw enables the injection of arbitrary JavaScript into the front‑end of a site, leading to the execution of malicious code within visitor browsers. The impact can include session hijacking, defacement, or theft of sensitive data from users who view the affected pages.

Any WordPress site that has installed the Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin by mihail‑barinov with a version equal to or less than 2.51 is affected. Sites granting Contributor‑level or higher capabilities to users are at risk because the authorization check is bypassed when those users attempt to save label meta boxes.

The CVSS score of 5.4 reflects a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating that it is not a widely known exploitation vector. The attacker must be authenticated with at least Contributor access, so the risk is limited to sites that have granted such permissions. However, once the flaw is exploited, malicious script can operate with the privileges of the page visitor, which can lead to data exfiltration or further attacks on site users. The lack of publicly known exploits suggests that the window for exploitation may be narrow, but the potential damage warrants timely remediation.