EUVD-2026-37624Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-reachable XSS requiring victim click (UI:R); script runs in WordPress origin causing scope change with limited C/I/A impact on the admin session.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.
AnalysisAI
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 score of 7.1 reflects the scope-changed impact (S:C) on the WordPress site, including potential session hijacking of administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
WPFunnels Pro is a commercial sales-funnel builder plugin for WordPress used to construct multi-step checkout, opt-in and upsell flows. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input reaches an HTML/JavaScript context without proper output encoding or sanitization. Because the CPE wildcard 'cpe:2.3:a:wpfunnels:wpfunnels_pro:*' covers all versions through 2.9.4, the vulnerable sink is likely a long-standing template, shortcode, or AJAX endpoint that renders attacker-supplied data into pages served by the plugin's funnel front-end.
RemediationAI
Upgrade WPFunnels Pro to the version released after 2.9.4 as documented in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpfunnels-pro/vulnerability/wordpress-wpfunnels-pro-plugin-2-9-4-cross-site-scripting-xss-vulnerability); no specific fixed version is stated in the available input, so verify the exact patched release on the vendor changelog before deploying. If immediate patching is not possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to filter script-like payloads on plugin endpoints, restrict access to funnel pages to authenticated users where feasible, and enforce a strict Content-Security-Policy that disallows inline scripts - noting that CSP may break legitimate inline scripts that WPFunnels itself injects into funnel pages and should be tested in staging. Administrators should also rotate sessions and reset credentials if exploitation is suspected.
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all ve
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visi
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured or
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remot
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers t
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remot
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnel
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today