WPFunnels CVE-2026-27371

Exploitation requires a victim with an active browser session to click or load an attacker-crafted URL that injects script into a WPFunnels page (reflected XSS), so success is gated by user interaction (UI:R) even though no authentication is needed (PR:N). The affected component is any WordPress site running the WPFunnels plugin at version 3.13.1 or earlier; impact is limited to the victim's browser context within the site origin (client-side script execution), not the server. There is no requirement for a special non-default configuration beyond having the vulnerable plugin installed and the vulnerable endpoint reachable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated reflected XSS that requires victim user interaction (clicking a crafted link) and produces a scope change with limited confidentiality, integrity and availability impact - a signature consistent with browser-context script execution rather than server compromise. No EPSS score, KEV entry, or SSVC decision data was supplied, and no public exploit is referenced, so exploitation probability cannot be quantified from the input. There is no signal of active exploitation: this is a Patchstack-catalogued WordPress plugin XSS that should be treated as a real-but-moderate priority - genuinely unauthenticated and network-facing, but gated by required user interaction and limited to client-side impact, so it is not a wormable or server-side RCE-class issue despite the 'High' 7.1 rating. Note a minor terminology conflict: the CVE description calls it 'Unauthenticated Cross Site Scripting' without specifying type, while the Patchstack reference title specifies 'reflected' XSS - the reflected classification is consistent with the UI:R requirement in the vector.

An attacker crafts a malicious URL targeting a vulnerable WPFunnels endpoint (<= 3.13.1) that reflects unsanitized input into the page, then delivers it to a victim via phishing email, forum post, or malicious link. When the victim's browser loads the link, attacker-controlled JavaScript executes in the site's origin, enabling session/cookie theft, admin-action forgery, or redirection. No public exploit code is referenced, though Patchstack maintains a proof-of-concept in its private database.