Cross-Site Request Forgery in Label Plugins for WordPress

CVE-2025-12401

What is CVE-2025-12401?

The Label Plugins plugin for WordPress is susceptible to Cross-Site Request Forgery, affecting all versions up to and including 0.5. The vulnerability arises from improper nonce validation in the label_plugins_options() function. As a result, unauthenticated attackers could potentially exploit this flaw to manipulate settings and inject malicious scripts. This exploitation requires deceiving an administrator into executing an action, such as clicking an infected link, permitting unauthorized alterations to the web application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References