The Whole Enquiry Cart for WooCommerce plugin for WordPress contains a stored cross‑site scripting flaw because the 'woowhole_success_msg' parameter is not properly sanitized or escaped. An attacker who is authenticated and has administrator-level permissions can inject arbitrary JavaScript code that will be rendered whenever a visitor loads a page containing the injected message. This client‑side code execution can be used to deface the site, steal credentials, or deliver other malicious payloads to site users.

The vulnerability afflicts every installation of idealwebdesignlk's Whole Enquiry Cart for WooCommerce plugin whose version is 1.2.1 or older. It only exists on WordPress multisite networks where the 'unfiltered_html' capability has been disabled, and it requires the attacker to have administrator or similar high‑privilege access. Sites running newer versions or not using the plugin are not impacted.

The CVSS Base score is 4.4, indicating medium severity. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog. Exploitation requires prior authentication with administrator privileges; once the malicious script is stored, any site visitor will be exposed to the injected code. Because the flaw is a stored XSS, the potential impact on confidentiality, integrity, or availability of the site and its users is significant, but the likelihood of exploitation is limited without an existing administrator account.