PT-2026-30343 · Getwpfunnels · Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell

Paolo Tresso · Published 2026-04-04 · Updated 2026-04-04 · CVE-2026-0626

Mitre

CVSS v3.1

6.4

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf optin form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0626

Affected Products

Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell

References · 2

• https://wordfence.com/threat-intel/vulnerabilities/id/2130847a-b6c5-412e-8d90-ba42d3fb21f6?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3439366/wpfunnels/trunk/includes/core/shortcodes/templates/optin/form.php · Note