CVE-2026-2838 is a stored cross-site scripting vulnerability in the Whole Enquiry Cart for WooCommerce plugin for WordPress, affecting all versions up to 1.2.1. The issue is due to improper neutralization of input in the 'woowhole_success_msg' parameter, allowing authenticated administrators to inject arbitrary scripts. This vulnerability specifically impacts multi-site WordPress installations or those with unfiltered_html disabled. Exploitation requires administrator privileges and does not involve user interaction. The CVSS 3.1 base score is 4.4 (medium), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An authenticated attacker with administrator-level access can inject malicious scripts that execute in the context of users visiting the injected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. The vulnerability only affects multi-site installations or those with unfiltered_html disabled, limiting the scope of impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only, especially on multi-site installations or sites with unfiltered_html disabled. Consider disabling or restricting the use of the 'woowhole_success_msg' parameter if possible. Monitor official channels for updates or patches from the vendor.