PT-2026-32598 · WordPress · Wholesale Products Dynamic Pricing Management

Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-4479

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress versions up to 1.2

Description Stored Cross-Site Scripting occurs via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions and above can inject arbitrary web scripts into pages, which execute when a user accesses them. This issue affects multi-site installations and installations where the unfiltered html variable has been disabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4479

Affected Products

Wholesale Products Dynamic Pricing Management

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4479 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6b0382e2-e029-4e19-981c-6dc570e182f0?source=cve · Note
• https://twitter.com/CVEnew/status/2043976132609859959 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043931833415430304 · Twitter Post
• https://twitter.com/CVEarity/status/2044319856917655722 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wholesale-products-dynamic-pricing-management-woocommerce/trunk/class-main.php#L114 · Note