Theode Label Plugins for WordPress versions up to 0.5 contain a CSRF vulnerability due to inadequate nonce validation in the label_plugins_options() function. This allows attackers to craft malicious requests that, when executed by an authenticated administrator, can modify plugin settings or inject malicious web scripts. The vulnerability does not require prior authentication but depends on social engineering to convince an administrator to trigger the malicious request. The CVSS 3.1 base score is 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There are no known exploits in the wild and no vendor-provided patches or advisories at this time.

Successful exploitation can lead to unauthorized modification of plugin settings and injection of malicious scripts, potentially compromising site integrity and confidentiality. The vulnerability requires user interaction by an administrator, limiting the ease of exploitation. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with unsolicited links and avoid performing administrative actions from untrusted sources. Monitoring for plugin updates from theode is recommended to apply any future patches promptly.