What is the CVSS score of EUVD-2026-18991?

EUVD-2026-18991 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-18991

| CVE-2026-0626 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

GHSA-3j3p-4gr4-4r5f

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 11:30 euvd

EUVD-2026-18991

Analysis Generated

Apr 04, 2026 - 11:30 vuln.today

CVE Published

Apr 04, 2026 - 11:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The WPFunnels - Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting (XSS) in WPFunnels - Easy Funnel Builder plugin for WordPress versions up to 3.7.9 allows authenticated contributors and higher-privileged users to inject arbitrary JavaScript via the 'button_icon' parameter in the 'wpf_optin_form' shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, potentially compromising website visitors and enabling session hijacking, credential theft, or malware distribution. This vulnerability requires authenticated attacker access but affects all site visitors who view injected pages.

Technical ContextAI

The vulnerability exists in the WPFunnels plugin's shortcode handler for 'wpf_optin_form', which processes user-supplied parameters including 'button_icon' without adequate sanitization before output. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin fails to escape user input when rendering HTML in page content. WordPress shortcodes are parsed and executed server-side during page rendering; the 'button_icon' parameter is inserted directly into the DOM without sanitization, allowing attackers to break out of intended context and inject malicious HTML/JavaScript. The affected CPE string indicates this impacts the WPFunnels - Funnel Builder for WooCommerce plugin across all versions through 3.7.9. The vulnerability is exploitable because shortcodes are often processed with contributor-level permissions, and the output is served to all visitors without additional filtering.

RemediationAI

Update the WPFunnels plugin to version 3.7.10 or later, which contains fixes for input sanitization and output escaping of the 'button_icon' parameter. The patch is available through the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3439366/wpfunnels/trunk/includes/core/shortcodes/templates/optin/form.php). Site administrators should immediately apply the update via the WordPress admin dashboard under Plugins > Installed Plugins. Until the patch can be deployed, consider temporarily restricting contributor-level access to page creation or disabling the WPFunnels plugin. For additional guidance, refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2130847a-b6c5-412e-8d90-ba42d3fb21f6?source=cve. After patching, audit existing pages created by untrusted contributors for injected shortcode parameters.