CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Stored XSS.This issue affects Advanced Woo Labels: from n/a through <= 2.15.
Explanation of Vulnerability in Simple Terms
Advanced Woo Labels versions 2.15 and earlier contain a cross-site scripting vulnerability. An attacker with low-level site access can inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction to trigger. Successful exploitation allows theft of session tokens, account hijacking, or malware distribution to site visitors.
What an attacker can do
Inject malicious scripts that run in other users' browsers to steal credentials or hijack accounts.
Potential impact on your site
Site visitors and administrators can be compromised; attackers may steal admin sessions or redirect users to malicious sites.
Conditions required to exploit
Attacker needs low-level site access (e.g., subscriber or contributor role) and victim must visit an affected page.
Key dates
External resources
