Wholesale Products Dynamic Pricing Management Woocommerce CVE-2026-4479

The CVSS score of 4.4 indicates low-to-moderate severity, and several factors validate this assessment. The attack requires high privilege level (PR:H-administrator credentials), high attack complexity (AC:H), and no user interaction (UI:N), limiting the practical attack surface to compromised or malicious administrators. The EPSS score is not provided, but based on CVSS metrics, real-world exploitation probability is low due to the requirement for administrative compromise as a prerequisite. The vulnerability is NOT in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code is referenced, indicating this is not actively exploited in the wild. However, the stored nature of the XSS (not reflected) means that once injected, the payload persists and automatically executes for all site visitors without additional attacker interaction, amplifying impact across the user base. The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N). For most organizations, this represents a lower-priority issue unless the threat model includes compromised administrator accounts; however, organizations with strict multi-site governance or shared hosting environments should prioritize patching to prevent privilege-abuse scenarios.

An organization with a WordPress multi-site installation appoints a malicious or compromised administrator who accesses the WholeSale Products Dynamic Pricing Management settings panel and injects a JavaScript payload into a product pricing field. The injected script is stored in the database without proper sanitization. When any user (including site owners or customers) accesses a page displaying the affected product or pricing information, the injected JavaScript executes in their browser, potentially stealing session cookies, capturing form input, or redirecting users to phishing pages. Because the attack is stored, it persists until the administrator or a higher-privileged user discovers and removes the malicious content.