The Advanced Woo Labels plugin for WordPress contains a stored Cross‑Site Scripting vulnerability that is triggered by the bg_color parameter. Because the input is not sanitized and the output is not properly escaped, an attacker who is logged in with contributor-level or higher privileges can embed arbitrary JavaScript. When an affected page is viewed, the script runs in the browser context of any visitor, allowing theft of session cookies, defacement, or further malicious activity. The weakness is identified as CWE‑79, a classic reflected XSS flaw now stored in the database.

The issue affects the Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin. All releases up to and including version 2.48 are vulnerable. The product is used on WordPress‑based WooCommerce e‑commerce sites that have enabled the plugin.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of <1% indicates exploitation is currently unlikely. The vulnerability requires authenticated access at the contributor level or higher, so it is not a public remote exploit. The flaw is not listed in the CISA KEV catalog, reducing the likelihood of a widespread attack. Nevertheless, any site that relies on this plugin and has contributor or higher privilege accounts should consider it a medium‑to‑high risk, especially if sensitive customer data is displayed through affected product pages.