CVE-2025-12401 - Label Plugins <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Back Back to CVE browser

MEDIUM

Label Plugins <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published Nov 4, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.16%

Description

The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the label_plugins_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

Vendor Theode Product Label Plugins Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=0.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Theode

Label Plugins

unaffected

Version	Status	Constraints
-	affected	<=0.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-37621		Advisory
https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L35
https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L37
https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L70
https://www.wordfence.com/threat-intel/vulnerabilities/id/843cc5e7-7820-409c-8de0-bd70245811cd?source=cve