EUVD-2026-22219
GHSA-gpxf-gw3r-8vx4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in WholeSale Products Dynamic Pricing Management WooCommerce plugin allows authenticated administrators to inject arbitrary web scripts via admin settings that execute for all users on affected pages. The vulnerability affects all versions up to and including 1.2 on multi-site WordPress installations or single-site installations with unfiltered_html disabled. While the CVSS score of 4.4 is moderate, exploitation requires high-privilege administrator credentials and the attack is limited by high attack complexity; however, the persistent nature of stored XSS means injected payloads affect all subsequent site visitors.
Technical ContextAI
This vulnerability is a Stored Cross-Site Scripting (CWE-79) vulnerability affecting the WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress (CPE:2.3:a:wpcodefactory:wholesale_products_dynamic_pricing_management_woocommerce). The plugin fails to properly sanitize and escape user input in admin settings fields, allowing malicious scripts to be stored in the database and subsequently reflected to all users who access pages containing the injected content. The vulnerability is specifically triggered through inadequate input validation in the admin settings interface (referenced in class-main.php around line 114), where the plugin accepts user-supplied data without sufficient sanitization before storage or output escaping before rendering. The attack vector is network-based (AV:N) but requires administrator-level privileges (PR:H), and the scope is changed (S:C), meaning the vulnerability can affect resources beyond the security scope of the vulnerable component-in this case, JavaScript execution in the context of legitimate site pages.
RemediationAI
The primary remediation is to upgrade the WholeSale Products Dynamic Pricing Management WooCommerce plugin to a patched version above 1.2; however, the exact patched version is not provided in the available data. Website administrators should check the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/wholesale-products-dynamic-pricing-management-woocommerce/) for the latest release or contact the plugin developer (WP Code Factory) for patch availability. As an interim workaround, restrict the administrator role to only trusted personnel and consider using the WordPress role editor to remove access to plugin settings for non-essential administrators. Additionally, enable the unfiltered_html capability restriction across all installations to leverage WordPress's built-in sanitization, though this may affect some legitimate functionality requiring HTML input. Monitor admin activity logs for any suspicious settings changes, and audit existing admin settings for injected script content that may have been stored in previous versions.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today