CVE-2026-4479 is a stored cross-site scripting vulnerability (CWE-79) in the WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress. It allows authenticated administrators to inject arbitrary web scripts via admin settings due to improper input neutralization during web page generation. This vulnerability affects multi-site installations and setups where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and required high privileges. No patch or official remediation has been disclosed as of the publication date.

An attacker with administrator-level permissions can inject malicious scripts that execute when users access the affected pages, potentially leading to session hijacking, defacement, or other script-based attacks. The impact is limited to multi-site WordPress environments or those with unfiltered_html disabled, reducing the overall attack surface. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider monitoring for suspicious admin activity. Avoid using the plugin in multi-site environments or where unfiltered_html is disabled if possible. Follow vendor updates closely for any forthcoming patches or mitigations.