Wpfunnels Funnel Builder For Woocommerce With Checkout One Click Upsell
CVE-2026-0626
|
EUVD-2026-18991
MEDIUM
GHSA-3j3p-4gr4-4r5f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The WPFunnels - Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting (XSS) in WPFunnels - Easy Funnel Builder plugin for WordPress versions up to 3.7.9 allows authenticated contributors and higher-privileged users to inject arbitrary JavaScript via the 'button_icon' parameter in the 'wpf_optin_form' shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, potentially compromising website visitors and enabling session hijacking, credential theft, or malware distribution. This vulnerability requires authenticated attacker access but affects all site visitors who view injected pages.
Technical ContextAI
The vulnerability exists in the WPFunnels plugin's shortcode handler for 'wpf_optin_form', which processes user-supplied parameters including 'button_icon' without adequate sanitization before output. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin fails to escape user input when rendering HTML in page content. WordPress shortcodes are parsed and executed server-side during page rendering; the 'button_icon' parameter is inserted directly into the DOM without sanitization, allowing attackers to break out of intended context and inject malicious HTML/JavaScript. The affected CPE string indicates this impacts the WPFunnels - Funnel Builder for WooCommerce plugin across all versions through 3.7.9. The vulnerability is exploitable because shortcodes are often processed with contributor-level permissions, and the output is served to all visitors without additional filtering.
RemediationAI
Update the WPFunnels plugin to version 3.7.10 or later, which contains fixes for input sanitization and output escaping of the 'button_icon' parameter. The patch is available through the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3439366/wpfunnels/trunk/includes/core/shortcodes/templates/optin/form.php). Site administrators should immediately apply the update via the WordPress admin dashboard under Plugins > Installed Plugins. Until the patch can be deployed, consider temporarily restricting contributor-level access to page creation or disabling the WPFunnels plugin. For additional guidance, refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2130847a-b6c5-412e-8d90-ba42d3fb21f6?source=cve. After patching, audit existing pages created by untrusted contributors for injected shortcode parameters.
Privilege escalation in the WPFunnels (Funnel Builder for WooCommerce) plugin for WordPress lets authenticated users hol
Local File Inclusion in the WPFunnels WordPress plugin (all versions through 3.12.7) allows authenticated administrators
Price manipulation via missing authorization in WPFunnels plugin for WordPress (all versions ≤3.12.13) lets unauthentica
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today