WPFunnels CVE-2026-62029

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) that can reach and submit data to a WPFunnels input that is persistently stored, and it further requires a second, typically higher-privileged user to load the page where the stored payload renders (UI:R) for the script to fire. Limiting factors: the attacker must already have a valid account on the target site, the configuration must allow that role to write to the vulnerable funnel field, and payload execution is contingent on another user viewing the affected content - so sites that do not grant untrusted users posting/configuration access are not realistically exploitable. Affects WPFunnels versions up to and including 3.13.3.

This is a stored Cross-Site Scripting (CWE-79) flaw in the WPFunnels WordPress plugin, rated CVSS 6.5 (Medium) via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vector indicates network-reachable, low-complexity exploitation but requires low-privilege authentication (PR:L) and victim user interaction (UI:R), which materially reduces real-world risk versus an unauthenticated, no-interaction flaw. The scope change (S:C) and persistent nature are the aggravating factors: injected script is stored server-side and executes in another user's (e.g., administrator's) browser session, which is why the limited C/I/A impacts still produce a Medium score. No EPSS score, KEV listing, or POC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - signals are consistent rather than conflicting (a low-to-moderate CVSS flaw with no exploitation intelligence). This is a routine patch-management priority, not an emergency: treat it as a standard plugin update to remediate, elevated only for sites that grant untrusted users contributor/author-level access. EPSS and POC status are missing from the input and should be verified against the Patchstack advisory.

An authenticated low-privilege user (such as a contributor or shop manager permitted to configure funnels) submits a crafted payload into a WPFunnels input field that is stored without proper neutralization. When an administrator or other user later views the affected page in wp-admin, the stored JavaScript executes in their authenticated session, enabling session/cookie theft or admin actions on their behalf. No public exploit code is referenced in the supplied data.