{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12241",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:31:56.089421Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:52.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Woo Labels \u2013 Product Labels \u0026 Badges for WooCommerce",
          "vendor": "mihail-barinov",
          "versions": [
            {
              "lessThanOrEqual": "2.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osvaldo Noe Gonzalez Del Rio (Os)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Advanced Woo Labels \u2013 Product Labels \u0026 Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the \u0027save_meta_boxes\u0027 function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T04:27:33.782Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a08d9118-3615-4f8e-a1cc-ba7e7873b7e5?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/admin/class-awl-admin.php#L121"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/advanced-woo-labels.php#L219"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-label-view.php#L145"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-taxonomy.php#L116"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-taxonomy.php#L78"
        },
        {
          "url": "https://kramakit.com/guide/free-version-changelog-awl/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-15T05:52:44.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-30T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Advanced Woo Labels \u2013 Product Labels \u0026 Badges for WooCommerce \u003c= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-12241",
    "datePublished": "2026-10-01T04:27:33.782Z",
    "dateReserved": "2026-06-15T05:36:30.570Z",
    "dateUpdated": "2026-10-03T15:42:52.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-12241\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-03T15:31:56.089421Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-03T15:41:18.595Z\"}}], \"cna\": {\"title\": \"Advanced Woo Labels \\u2013 Product Labels \u0026 Badges for WooCommerce \u003c= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Osvaldo Noe Gonzalez Del Rio (Os)\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"mihail-barinov\", \"product\": \"Advanced Woo Labels \\u2013 Product Labels \u0026 Badges for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.51\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-15T05:52:44.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-09-30T00:00:00.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08d9118-3615-4f8e-a1cc-ba7e7873b7e5?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/admin/class-awl-admin.php#L121\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/advanced-woo-labels.php#L219\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-label-view.php#L145\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-taxonomy.php#L116\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/class-awl-taxonomy.php#L78\"}, {\"url\": \"https://kramakit.com/guide/free-version-changelog-awl/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Advanced Woo Labels \\u2013 Product Labels \u0026 Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the \u0027save_meta_boxes\u0027 function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-01T04:27:33.782Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-12241\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-03T15:42:52.868Z\", \"dateReserved\": \"2026-06-15T05:36:30.570Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-01T04:27:33.782Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}