CVE-2026-4479: WooCommerce Dynamic Pricing XSS Vulnerability

CVE-2026-4479 Overview

The WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in all versions up to, and including, 1.2. This vulnerability arises from insufficient input sanitization and output escaping in the plugin's administrative interface. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts into pages that execute whenever a user accesses the affected page.

Critical Impact

This vulnerability allows administrators to inject persistent malicious scripts that execute in the context of other users' sessions, potentially enabling session hijacking, credential theft, or unauthorized administrative actions on WordPress multi-site installations.

Affected Products

• WholeSale Products Dynamic Pricing Management WooCommerce plugin versions up to and including 1.2
• WordPress multi-site installations with the affected plugin
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-4479 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-4479

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the admin settings functionality of the WholeSale Products Dynamic Pricing Management WooCommerce plugin. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack requires network access and high privileges (administrator-level), but once exploited, the impact extends to other users accessing the injected pages, allowing cross-scope attacks.

The vulnerability specifically affects environments where additional security controls have been implemented. This includes WordPress multi-site installations and configurations where the unfiltered_html capability has been explicitly disabled—ironically, environments that have attempted to harden their security posture are the ones affected.

Root Cause

The root cause stems from insufficient input sanitization and output escaping within the plugin's administrative settings processing. The vulnerable code is located in class-main.php at line 114, where user-supplied input from admin settings fields is stored without proper sanitization and subsequently rendered without adequate output escaping. This allows malicious JavaScript code to be stored in the database and executed when the settings page or affected frontend pages are rendered.

Attack Vector

The attack is network-based and requires an authenticated attacker with administrator-level permissions. The attacker injects malicious JavaScript code through the plugin's admin settings fields. When other users (including other administrators) access pages where this content is displayed, the malicious script executes in their browser context.

The attack scenario involves:

1. An attacker with administrator access navigates to the WholeSale Products Dynamic Pricing Management settings
2. Malicious JavaScript is entered into vulnerable input fields that lack proper sanitization
3. The payload is stored in the WordPress database
4. When any user views the affected page, the script executes with their session privileges
5. The attacker can steal session cookies, perform actions as the victim, or redirect users to phishing pages

This vulnerability is particularly concerning in multi-site environments where multiple administrators may have access, as a compromised or malicious administrator on one site could potentially impact users across the network.

Detection Methods for CVE-2026-4479

Indicators of Compromise

• Unexpected JavaScript code present in the WholeSale Products Dynamic Pricing Management plugin settings stored in the WordPress database
• Unusual <script> tags or JavaScript event handlers in plugin configuration values
• Reports of unexpected browser behavior or redirects when accessing WooCommerce pricing pages
• Suspicious modifications to plugin settings by administrator accounts

Detection Strategies

• Audit database entries for the plugin's settings, searching for JavaScript patterns such as <script>, onerror=, onload=, or other HTML event handlers
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Review WordPress admin activity logs for unusual modifications to the WholeSale Products plugin settings
• Deploy web application firewall (WAF) rules to detect XSS payloads in administrative requests

Monitoring Recommendations

• Enable comprehensive logging for WordPress admin actions, particularly settings changes
• Monitor for script execution anomalies using browser-based security tools or endpoint detection
• Configure alerting for any modifications to WooCommerce-related plugin settings
• Implement integrity monitoring for plugin database entries

How to Mitigate CVE-2026-4479

Immediate Actions Required

• Update the WholeSale Products Dynamic Pricing Management WooCommerce plugin to a patched version when available
• Review and audit current plugin settings for any injected malicious content
• Restrict administrator access to trusted users only
• Consider temporarily disabling the plugin on multi-site installations until a patch is released

Patch Information

Review the WordPress Plugin Source Code to understand the vulnerable code path. Monitor the Wordfence Vulnerability Report for updated patch information and remediation guidance.

Plugin administrators should check for updates regularly through the WordPress dashboard and apply security updates immediately when released.

Workarounds

• Implement strict Content Security Policy (CSP) headers to prevent inline script execution
• Use a Web Application Firewall (WAF) with XSS filtering rules enabled
• Limit administrator access to only essential personnel on multi-site installations
• Consider re-enabling unfiltered_html restrictions if they were disabled, as single-site installations are not affected by this vulnerability

# Add CSP headers in .htaccess or server configuration
# Example Apache configuration for XSS mitigation
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"