CVE-2024-10638

Product Labels For Woocommerce < 1.5.11 - Admin+ SQLi

4.1 Medium

The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.42%Up 0.4 points since Mar 25, 2025

What each source reports

CVE List Score used 4.1

Product Labels For Woocommerce < 1.5.11 - Admin+ SQLi

Record: CVE-2024-10638
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Updated: 2026-11-02

EUVDEUVD-2024-54528 4.1

Record: EUVD-2024-54528
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gqcv-v7gm-vw94 4.1

The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize...

Record: GHSA-gqcv-v7gm-vw94
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-89
Updated: 2026-11-02

NVD 4.1

Record: CVE-2024-10638
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-89
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10638 is a medium vulnerability (CVSS 4.1) in Unknown Product Labels For Woocommerce (sale Badges), published March 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.