WPFunnels Pro CVE-2026-49778

Exploitation requires a WordPress site running WPFunnels Pro at version 2.9.4 or earlier with funnel pages or affected endpoints reachable by the attacker, and per CVSS UI:R it requires the victim to perform an action such as clicking a crafted link or loading a page that includes the malicious input. No authentication is needed by the attacker (PR:N), but meaningful impact such as administrative takeover requires the victim to be an authenticated high-privilege WordPress user at the moment of script execution; targeting an anonymous site visitor yields only browser-context impact on that user.

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates remote, unauthenticated exploitation with low complexity, but requires victim interaction such as clicking a crafted link or visiting a malicious funnel page. The scope change (S:C) is what pushes the score to 7.1 - script executes in the security context of the WordPress site, enabling session theft against logged-in administrators and arbitrary actions on their behalf. EPSS and KEV data were not provided in the input, and no POC reference is included, so likelihood of mass exploitation is unconfirmed; however, WordPress plugin XSS is routinely weaponized in automated campaigns once disclosed, so it should be treated as a high-priority patch for any site running funnel pages on the public internet.

An attacker crafts a URL or funnel page parameter containing a JavaScript payload targeting the vulnerable WPFunnels Pro endpoint, then distributes it via phishing email, forum post, or malvertising. When a logged-in WordPress administrator clicks the link, the script executes in their browser session and silently creates a new admin account or exfiltrates the authentication cookie. No public POC is referenced in the available data, but XSS against WordPress plugins is trivial to weaponize once the injection point is known.