CVE-2026-2838

The Whole Enquiry Cart for WooCommerce plugin for WordPress versions up to 1.2.1 contains a stored cross-site scripting (XSS) vulnerability in the 'woowhole_success_msg' parameter caused by insufficient input sanitization and output escaping. The vulnerability is limited to multi-site WordPress installations or those with unfiltered_html disabled, and requires administrator-level authentication to exploit. The vulnerability carries a CVSS score of 4.4 (Medium severity) with a network attack vector and high attack complexity. While the potential impact is limited to low confidentiality and integrity compromise with no availability impact, the scope is changed, meaning the vulnerability could affect resources beyond the vulnerable component's security scope. The FAUCET risk score of 30.0/100 indicates moderate overall risk. This vulnerability is not currently being exploited in the wild, with no documented public exploit code available or community-driven exploitation activity. The absence from the Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists suggest this remains a lower-priority threat. Organizations should apply available patches during routine maintenance cycles while prioritizing other security issues with higher exploitation risk.