Stored Cross-Site Scripting Vulnerability in WPFunnels Plugin for WordPress
CVE-2026-0626

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
WPfunnels – Funnel Builder For WooCommerce With Checkout & One Click Upsell
Vendor
CVE Published:
4 April 2026

What is CVE-2026-0626?

The WPFunnels plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability via the 'wpf_optin_form' shortcode. This security flaw arises from inadequate input sanitization and output escaping of the 'button_icon' parameter. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into WordPress pages. As a result, any user accessing the compromised pages may unknowingly trigger the execution of malicious scripts, potentially leading to data theft or other security issues.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell 0 <= 3.7.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3439366/wpfu...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Paolo Tresso
JSON
.