EUVD-2026-22219
GHSA-gpxf-gw3r-8vx4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in WholeSale Products Dynamic Pricing Management WooCommerce plugin allows authenticated administrators to inject arbitrary web scripts via admin settings that execute for all users on affected pages. The vulnerability affects all versions up to and including 1.2 on multi-site WordPress installations or single-site installations with unfiltered_html disabled. While the CVSS score of 4.4 is moderate, exploitation requires high-privilege administrator credentials and the attack is limited by high attack complexity; however, the persistent nature of stored XSS means injected payloads affect all subsequent site visitors.
Technical ContextAI
This vulnerability is a Stored Cross-Site Scripting (CWE-79) vulnerability affecting the WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress (CPE:2.3:a:wpcodefactory:wholesale_products_dynamic_pricing_management_woocommerce). The plugin fails to properly sanitize and escape user input in admin settings fields, allowing malicious scripts to be stored in the database and subsequently reflected to all users who access pages containing the injected content. The vulnerability is specifically triggered through inadequate input validation in the admin settings interface (referenced in class-main.php around line 114), where the plugin accepts user-supplied data without sufficient sanitization before storage or output escaping before rendering. The attack vector is network-based (AV:N) but requires administrator-level privileges (PR:H), and the scope is changed (S:C), meaning the vulnerability can affect resources beyond the security scope of the vulnerable component-in this case, JavaScript execution in the context of legitimate site pages.
RemediationAI
The primary remediation is to upgrade the WholeSale Products Dynamic Pricing Management WooCommerce plugin to a patched version above 1.2; however, the exact patched version is not provided in the available data. Website administrators should check the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/wholesale-products-dynamic-pricing-management-woocommerce/) for the latest release or contact the plugin developer (WP Code Factory) for patch availability. As an interim workaround, restrict the administrator role to only trusted personnel and consider using the WordPress role editor to remove access to plugin settings for non-essential administrators. Additionally, enable the unfiltered_html capability restriction across all installations to leverage WordPress's built-in sanitization, though this may affect some legitimate functionality requiring HTML input. Monitor admin activity logs for any suspicious settings changes, and audit existing admin settings for injected script content that may have been stored in previous versions.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today