CVE-2026-2838 is a stored cross-site scripting vulnerability in the Whole Enquiry Cart for WooCommerce plugin for WordPress. It arises from insufficient input sanitization and output escaping of the ‘woowhole_success_msg’ parameter, allowing authenticated administrators to inject arbitrary web scripts. The vulnerability specifically impacts multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4 (medium), with attack vector network, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity. No patch or official remediation is currently documented.

An authenticated attacker with administrator privileges can inject malicious scripts that execute in the context of users visiting the injected pages, potentially leading to partial confidentiality and integrity compromise. The vulnerability affects multi-site WordPress setups or those with unfiltered_html disabled. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider limiting multi-site installations or enabling unfiltered_html if appropriate. Monitor official vendor channels for updates and apply patches promptly once released.