WholesaleX – All-in-One B2B Solution with Wholesale Pricing
WholesaleX – All-in-One B2B Solution with Wholesale Pricing has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2024 was the busiest year with 4 disclosures.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 2 of the records (33%). Other recurring categories include Improper Privilege Management, Deserialization Of Untrusted Data.
Every one of the 6 issues recorded for WholesaleX – All-in-One B2B Solution with Wholesale Pricing has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, most of them (2) reported by Emili Castells. WholesaleX – All-in-One B2B Solution with Wholesale Pricing is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2024-30224WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) <= 1.3.2 - Unauthenticated PHP Object Injection
Read the full analysisVulnerability Records

WholesaleX – All-in-One B2B Solution with Wholesale Pricing
Author
WPXPO
woocommerceWholesaleX helps you create and manage a B2B wholesale store or a B2B+B2C hybrid store with WooCommerce. Set role-based wholesale prices, manage customer registration and approval, and control access to your store and prices. Developed by WPXPO. WholesaleX Pro | Documentation | Support Included in Free The features in the following Free sections work without a WholesaleX Pro license. They do not expire after a trial period or usage quota. Wholesale pricing: Set role-based wholesale prices from WooCommerce product pages or create pricing rules. Product targeting: Apply pricing to all products, specific products, categories or variations, with product exclusions. Scheduled pricing: Choose a start date, an end date or both for a pricing rule. Customer roles: Create and manage B2B and wholesale customer roles. Tax settings: Configure role-based tax display and tax exemption rules. Payment and shipping methods: Choose which payment and shipping methods are available to each wholesale role. Automatic role migration: Move customers to a wholesale role when their total spending reaches its configured threshold. Registration and login forms: Build forms using the included standard registration fields. Customer approval: Choose automatic approval, email confirmation or manual administrator approval, and configure login behavior. Private-store and hide-price controls: Require customers to log in before accessing protected store content or prices. Separate B2B stock: Manage wholesale stock separately and control how stock availability is displayed. Customer management: Manage approval and role-change requests, and import or export customer records using CSV files. Pricing previews: Preview included pricing rules in the builder and check storefront pricing with the role preview tool. Advanced wholesale pricing setup — Free Create wholesale offers without changing the regular prices shown to other customer groups. Choose your customers Target guests and registered customers, B2B roles, specific roles or individual customers using the selectors available for the rule. Choose your products Apply a rule to all products, specific products, categories or variations. Exclude products that should keep their existing pricing. Choose a discount type Percentage: Reduce the selected base price by a percentage. Amount: Deduct a fixed amount from the selected base price. Fixed: Set an exact price for the selected products. Configure discounts against regular or sale prices where supported by the pricing settings. Schedule a start date, an end date or both, and preview the rule before checking it on the storefront. Dynamic discount rules — Free Create promotional offers for selected customers and products. Product Discount: Discount selected products and schedule the offer. Cart Discount: Apply discounts with supported cart quantity, value or weight conditions. Buy X Get One Discounted: Discount one item when customers buy the required quantity. Advanced conditions based on lifetime orders or lifetime spending are supplied by the separate Pro add-on. Wholesale user roles — Free Create B2B roles for groups such as distributors, retailers and VIP customers. Assign payment methods, shipping methods and tax settings to the appropriate roles. Customers can migrate into a user role automatically based purchasing amount condition. Registration form builder — Free Create a registration and login experience using the included standard fields. Add, remove and arrange standard registration fields. Display registration and login forms together or separately. Choose automatic approval, email confirmation or manual approval. Place forms on a page using the plugin’s registration block or shortcodes. Additional custom field types and advanced field conditions are supplied by Pro. Private-store mode — Free Restrict guest access, redirect logged-out visitors to a selected page, allow selected URLs and display login prompts where prices require authentication. Use these settings to separate public retail browsing from protected wholesale access. Registration email templates — Free Customize the included registration emails for events such as new registrations, email verification, account approval and rejection. Pro supplies the templates for its quote, subaccount, conversation and wallet features. B2B and B2B+B2C hybrid stores — Free Run a wholesale-only store or serve wholesale and retail customers together. Use the appropriate pricing and customer roles for each group. You can manage separate B2B stock and choose whether to show stock quantities, availability only or no stock information. Optional reCAPTCHA — Free Configure Google reCAPTCHA v2 or v3 for supported login and registration forms. It is disabled until an administrator enables it and supplies the required keys. See External services for the data shared with Google. Extending WholesaleX The following features are supplied by separately installed add-ons. They are not implementations included in WholesaleX Free. WholesaleX Pro — separate paid add-on WholesaleX Pro requires WholesaleX Free. It provides: Tiered pricing and tier tables: Quantity-based price tiers for products, categories and customer profiles. Advanced pricing restrictions: Minimum and maximum quantities, quantity steps and order-value restrictions in the Wholesale Pricing builder. Buy X Get Y: Offers that grant configured free products. Advanced targeting and conditions: Additional product selectors and customer-history conditions, including lifetime orders and spending. Custom registration fields: Additional field types and advanced field conditions. Advanced role controls: Additional product visibility, purchasing, checkout and other role restrictions. Bulk ordering: A bulk order form and table for placing larger orders. Request a Quote: Quote requests for selected products and customers. Conversations: Customer and store-administrator messaging. Subaccounts: Purchasing accounts for a customer’s team members. WholesaleX Wallet: Customer wallet balances and wallet payments. White label: Branding controls for stores built for clients. Pro email templates: Notifications for quotes, subaccounts, conversations and wallet activity. If Pro is unavailable, Free retains saved Pro settings and rules without running those features. Free features continue to work independently of a Pro license. Separate free companion plugins WholesaleX for Dokan: Wholesale integration for Dokan marketplaces. WholesaleX for WCFM: Wholesale integration for WCFM marketplaces. Each companion requires its corresponding marketplace plugin. Pro features still require WholesaleX Pro. A unified wholesale workflow Manage pricing, customer targeting, registration, approval, private-store settings and role migration in the same plugin. The separate Pro add-on extends this workflow with tiered pricing, bulk ordering, quotes and its other listed features. Videos WPGIZ has published a video review of WholesaleX. It may demonstrate features from both Free and Pro. The following video introduces the WholesaleX workflow and may also show Pro features: User reviews of WholesaleX and WholesaleX Pro The following user feedback includes experiences with the paid Pro add-on. Features mentioned in a review are included in Free only if listed in the Free sections above. I’ve been using a competitor plugin before, but WholesaleX blows it away with its comprehensive setup for B2B and B2C — handling dynamic tiered pricing, quantity discounts, bulk orders, and hidden guest prices all in one smooth package. Setup is quick and intuitive, and the support team delivers custom fixes in under 24 hours. True game-changer for hybrid stores. I run a hybrid B2B+B2C store and WholesaleX has been absolutely perfect for my setup. The dynamic pricing rules are incredibly powerful – tiered pricing, quantity discounts, BOGO deals without any hassle. The Request a Quote feature has been a game changer, and the bulk order form makes it easy for B2B customers to place large orders quickly. The plugin covers everything and more than what you would expect in a B2B solution. A big shout out to Shahriar who did not give up on me and went beyond the expected support. WholesaleX delivers a comprehensive, flexible wholesale solution for WooCommerce — dynamic pricing, tiered discounts, bulk orders, hidden prices for guests — everything I need to run both B2B and B2C smoothly. I purchased the plugin to build an exclusive B2B store in WordPress, keeping our B2C on Shopify. I needed a very specific discount model, and both the support and development teams were fantastic — they even adjusted the code to help me achieve what I needed. I use WholesaleX Pro and I find it very useful especially for B2B features. I use multiple levels of discounts for different types of users, and I really like the bulk ordering and order list option which is very useful for regular customers. The technical support is very proactive. Read user reviews on WordPress.org. Author and translations Developed by WPXPO. Contribute on Bitbucket. WholesaleX uses WordPress translation functions and the wholesalex text domain. Contribute translations at translate.wordpress.org or use translation tools such as Loco Translate. A multilingual compatibility integration is included for WPML. Source code and build tools Human-readable JavaScript/React and stylesheet source, dependency manifests and build tools are maintained in the development repository. Use the source revision corresponding to the plugin version you are rebuilding; the development branch may contain newer changes. In a separate development checkout, install the locked dependencies with npm ci, then run npm run build. This rebuilds production assets and creates a runtime-only plugin ZIP. See BUILDING.md in the repository for the build instructions. Production code uses WordPress-provided runtime libraries where available. Licenses and attribution WholesaleX is distributed under GPLv3. LICENSE.txt contains the plugin license and consolidated third-party license and attribution texts. Media ownership and licensing evidence is maintained in ASSET-PROVENANCE.json in the development repository. Developed by WPXPO. Translations are available at translate.wordpress.org. External services Google reCAPTCHA reCAPTCHA is optional spam protection. No Google script is loaded by this integration unless an administrator enables it and supplies both a site key and secret key. Configured registration and login forms, WordPress login and conversation forms load https://www.google.com/recaptcha/api.js when rendered. Google may load supporting resources from www.gstatic.com and other Google reCAPTCHA endpoints. The browser sends the public site key, IP address, browser/device information and site origin. reCAPTCHA uses cookies, including _GRECAPTCHA, for risk analysis. v2 presents a challenge; v3 obtains a response token when a protected form is submitted. For verification, the store server sends the secret key and response token to https://www.google.com/recaptcha/api/siteverify. The secret key is excluded from browser-localized settings. The plugin does not send registration field values, passwords, orders or license keys to this endpoint. Store operators should disclose the configured service to visitors in their privacy policy. Google Terms | Google Privacy Policy | reCAPTCHA FAQ | Verification data Optional YouTube tutorials Tutorial videos are provided by WPXPO and hosted by YouTube (Google). Opening an administrator tutorial with its video or Tutorial button loads the embedded player. Videos do not autoplay; playback begins when the administrator presses Play. Ordinary screen loading requests no YouTube player, remote thumbnail, preload or preconnect. The Overview preview is bundled locally. Closing the tutorial removes the player. After a tutorial is opened, the browser contacts https://www.youtube.com/embed/ and YouTube/Google media services, which may include youtube.com, ytimg.com, googlevideo.com, Google domains and advertising domains. Those services receive the administrator’s IP address, browser/device information, site origin and video ID, and may use cookies. The plugin sends no customer records to the tutorial service. Tutorials are optional and do not unlock local features. Video and preview credit: WPXPO, https://www.youtube.com/@wpxpo . The original Overview tutorial and bundled preview come from https://www.youtube.com/watch?v=ZbQLY21-cMA . Embedded videos remain hosted on YouTube. The bundled preview is WPXPO artwork distributed under this plugin’s GPLv3 license. YouTube Terms | Google Privacy Policy | YouTube player documentation WordPress.org plugin installation When an administrator chooses to install a directory integration on the Addons screen, the plugin uses WordPress’s plugin-information and installation APIs to retrieve the selected plugin from WordPress.org, including api.wordpress.org and downloads.wordpress.org. WordPress sends the selected plugin slug and standard HTTP request metadata, including the store server’s IP address and user agent. Installation requires an explicit administrator action and WordPress installation permissions. WholesaleX sends no customer records, passwords or license keys to the directory request. WordPress may contact its directory independently during its own update checks. Directory Guidelines | WordPress.org Privacy The videos embedded in the WordPress.org plugin listing are displayed by WordPress.org. They are separate from the optional tutorial players inside the plugin.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C