LabelGrid Tools
LabelGrid Tools has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for LabelGrid Tools has a vendor fix available, so running the current release closes it.
All of these findings were reported by thiennv. LabelGrid Tools is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-54341LabelGrid Tools <= 1.3.58 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

LabelGrid Tools
Author
LabelGrid
LabelGrid Tools turns your WordPress site into a complete music website for record labels, artists and distributors. Showcase your catalog with release landing pages, run Spotify pre-save campaigns and follow-to-download gates, and keep everything in sync with your LabelGrid catalog automatically. Built for the way labels actually work: your releases live on your own domain — landing pages, smart links and promo campaigns run on your website instead of a third-party link service, so the traffic, the SEO and the fan e-mails belong to you. Live Website to see all functionalities live. LabelGrid Tools Documentation More information on LabelGrid Tools Main Features Music catalog on your own site: Release and Artist post types with artwork, release dates, catalog numbers, UPC/ISRC, genres and record labels — plus Gutenberg blocks, shortcodes and Elementor widgets for release grids, artist rosters, banners and filtered lists that work with any theme or page builder. Block editor & Elementor ready: every feature is also a native Gutenberg block — find them in the block inserter under the LabelGrid Tools category — and works with Elementor and classic themes alike. Blocks are purely additive: pages you already built stay exactly as they are. Release landing pages (smart links): every release gets a landing page with streaming and store buttons for Spotify, Apple Music, iTunes, Beatport, Deezer, Tidal, YouTube, Amazon Music, SoundCloud, Bandcamp and more — plus press text, a Spotify player embed and distraction-free “lite” pages built for ad campaigns. Spotify Pre-Save campaigns: fans pre-save upcoming releases straight from your release page, optionally following your artists and playlists in the same step, with e-mail capture for your mailing list. Follow-to-download gates: give away free tracks in exchange for Spotify follows and saves, with e-mail capture, contest entries and download statistics. Automatic catalog sync: connect your LabelGrid account and your releases, artists, genres, artwork and store links import and stay updated automatically — no copy-pasting links on release day. Localized Apple links: iTunes and Apple Music buttons send each visitor to their own country’s storefront, with Apple Performance Partner Program affiliate support. Modern, translated admin: fast filterable log and entry screens built on WordPress 7’s DataViews interface, CSV exports, and full translations in English, Spanish, French, Italian and German. — LABELGRID ADVANCED FUNCTIONALITIES — LabelGrid Gate Tools are available only to LabelGrid customers subscribed to any paid plan or as a standalone add-on. Sign-up here LABELGRID SYNC: LabelGrid Tools can sync automatically Releases, Artists, Genres and Record Labels from LabelGrid databases directly to WordPress thanks to LabelGrid APIs. The plugin syncs your whole catalog automatically throughout the day, fetching new store links as they become available. No need to worry anymore about updating your website because LabelGrid Tools will do it for you. FREE DOWNLOAD GATES: Create Free Downloads with “Action-to-download” gates, supporting Spotify. The application will prompt customers to first “Connect” the requested services and then will automatically perform the configured actions. Once the customer has connected all the requested services the download will unlock automatically. Download Gates can also be set up to forward to URLs, so you could “Gate” for example your DEMO submission form page to ask users to follow your socials before being able to submit your content. SPOTIFY PRE-SAVES: Improve your pre-release sales with a Spotify Pre-Save. Optionally set up further actions that can have your users follow Playlists, Users or Artists. External services This plugin connects to the LabelGrid API (https://api.labelgrid.com) — a service operated by LabelGrid — to sync your catalog and to run download gates and Spotify pre-saves. The connection is only made once you enter a LabelGrid API key. Catalog sync. Your site requests your own releases, artists, genres and record labels. Your API key is sent to identify your account. No visitor data is involved. Download gates and pre-saves. When a visitor starts a gate or a pre-save, the plugin sends the LabelGrid API an anonymous session identifier generated by your site, the gate or release reference, and the actions you configured. The visitor is then sent to Spotify to authorize the connection, and Spotify returns an authorization to LabelGrid, which performs the saves and follows on the visitor’s behalf. Your site does not receive or store the visitor’s Spotify credentials. E-mail capture. If you enable e-mail collection on a gate, the address the visitor types is stored in your own WordPress database. It is not sent to the LabelGrid API. Service terms: https://labelgrid.com/terms/ Service privacy policy: https://labelgrid.com/privacy-policy/ Spotify’s terms apply to the authorization step: https://www.spotify.com/legal/end-user-agreement/ and https://www.spotify.com/legal/privacy-policy/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C