The WholeSale Products Dynamic Pricing Management WooCommerce plugin contains a stored cross‑site scripting flaw due to insufficient input sanitization and output escaping in the admin settings. Authenticated users with administrator‑level permissions can inject arbitrary JavaScript or other executable content into these settings. When a page reads the affected settings, the injected script executes in the browser of any visitor, potentially allowing cookie theft, session hijacking, or further exploitation of the site. The weakness maps to CWE‑79.

The vulnerability affects all installations of the WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress up to and including version 1.2. It only applies in multi‑site environments or where the unfiltered_html capability has been disabled, meaning the flaw is relevant to most typical WordPress deployments that use this plugin on multisite setups.

The CVSS base score of 4.4 puts the issue in the medium severity range. No EPSS score has been published and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not yet been widely exploited. Nevertheless, the requirement of administrator access in a multi‑site WordPress installation makes the attack surface significant for sites with a single compromised admin account. An attacker with such privileges can inject persistent scripts via the plugin settings page, which are delivered to every visitor of affected pages.