CVE-2026-15662

Name of the Vulnerable Software and Affected Versions Advanced Woo Labels – Product Labels & Badges for WooCommerce versions prior to 2.49

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the bg color parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update the plugin to a version newer than 2.48. As a temporary mitigation, restrict access to the bg color parameter for users with contributor-level permissions.