WPFunnels CVE-2026-97271

Exploitation requires WPFunnels plugin version 3.13.1 or earlier installed on a WordPress site, and - per UI:R in the CVSS vector - a victim must interact by loading or clicking an attacker-crafted request/link for the reflected script to execute. No authentication is required (PR:N), so any unauthenticated remote attacker can construct the payload, but success depends on tricking a user into triggering it; the impact is bounded to what JavaScript in the site origin can achieve (partial confidentiality/integrity/availability). The specific vulnerable parameter and endpoint are not disclosed in the available data, limiting precise detection.

This is an unauthenticated reflected/DOM-style XSS (CWE-79) in the WPFunnels WordPress plugin at versions <= 3.13.1, reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates network-reachable, low-complexity exploitation with no privileges but requiring user interaction (UI:R) - consistent with a reflected XSS where a victim must click or load a crafted link. The scope change (S:C) reflects script execution crossing from the injection point into the victim's browser/session context, and the C:L/I:L/A:L partial impacts are typical of XSS (session/token theft, limited defacement, minor disruption) rather than full account or server takeover. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no evidence of active exploitation or automation. The realistic verdict: a legitimate but moderate-priority issue - unauthenticated reach raises its ceiling, but the UI:R requirement and confidentiality/integrity limited to 'Low' keep it below the tier of a wormable or auth-bypass flaw. The unauthenticated nature is the most notable signal; treat as a patch-soon item rather than an emergency, absent exploitation evidence.

An attacker crafts a URL or form submission targeting a vulnerable WPFunnels endpoint that reflects unsanitized input into a page, then lures a site visitor or administrator into clicking it. When the victim's browser renders the response, the injected JavaScript executes in the site's origin, allowing session/cookie theft, action forgery, or content manipulation. No proof-of-concept code was identified in the provided sources.