The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin contains an improper neutralization of input during web page generation, enabling stored cross‑site scripting. Scripts supplied by a user are saved to the database and later rendered to any site visitor without proper escaping.

The vulnerability affects the WooCommerce wholesale‑pricing‑woocommerce plugin from its earliest release up to and including version 4.0.3. Users running any of those releases are at risk unless the plugin has already been updated to a version that addresses the flaw.

The CVSS score of 6.5 indicates a moderate severity issue. The EPSS score below 1% suggests a low probability of widespread exploitation. Attackers would need the ability to input and store data through the plugin’s configuration interface; subsequent visitors to pages that render this data can be exposed to the injected script. The impact appears to be confined to the web application and to users who view affected pages, with no indication in the description of privilege escalation.