Wpfunnels Funnel Builder For Woocommerce With Checkout One Click Upsell CVE-2026-0626

The CVSS score of 6.4 reflects moderate risk with a network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), but limited confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N). The requirement for authenticated attacker access (PR:L) significantly reduces real-world exploitability compared to unauthenticated XSS vulnerabilities. However, the scope change flag (S:C) indicates the vulnerability can affect resources beyond the vulnerable component-specifically, any user viewing the injected page becomes a victim, making this a stored XSS with cross-user impact. The reported vulnerability status is not marked as actively exploited by CISA KEV, and no public proof-of-concept code is confirmed in the provided data. The practical risk depends on WordPress installation policies: sites restricting contributor access or using role management plugins will have reduced attack surface. For sites with permissive contributor access or where attackers have compromised contributor accounts, this is a genuine stored XSS concern affecting all visitors. The Wordfence source and GitHub repository references suggest vendor awareness and likely patching availability.

An attacker with a WordPress contributor account (obtained through credential compromise, insider threat, or legitimate but malicious hire) navigates to the WordPress page/post editor and creates or modifies a page containing the [wpf_optin_form button_icon='<img src=x onerror="fetch('/api/steal-credentials')">'] shortcode. When any website visitor (including administrators) views the page, the injected JavaScript executes in their browser context, potentially stealing session cookies, capturing form data, or redirecting them to a phishing site. Because this is stored XSS, the attack persists until the page is deleted or the shortcode is manually corrected, making it a long-lived threat affecting all users repeatedly.