{"id":"CVE-2026-0626","aliases":["EUVD-2026-18991","GHSA-3j3p-4gr4-4r5f"],"status":"published","title":"WPFunnels \u003c= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode","description":"The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads \u0026 Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00203,"percentile":0.1034,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-04-04T11:16:13Z","modified":"2026-07-24T22:10:00Z","products":[{"vendor":"getwpfunnels","product":"wpfunnels – funnel builder for woocommerce with checkout \u0026 one click upsell"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2130847a-b6c5-412e-8d90-ba42d3fb21f6?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3439366/wpfunnels/trunk/includes/core/shortcodes/templates/optin/form.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0626"},{"url":"https://github.com/advisories/GHSA-3j3p-4gr4-4r5f"}],"sources":{"cve":[{"id":"CVE-2026-0626","title":"WPFunnels \u003c= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode","description":"The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads \u0026 Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-04T11:16:13.764Z","modified":"2026-04-08T16:41:23.537Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-18991","description":"The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads \u0026 Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-04T11:16:13Z","modified":"2026-04-08T16:41:23Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:06.507675Z"}],"ghsa":[{"id":"GHSA-3j3p-4gr4-4r5f","title":"The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads \u0026 Sales plugin...","description":"The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads \u0026 Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-04T12:31:03Z","modified":"2026-04-04T12:31:04Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:07:09.038762Z"}],"nvd":[{"id":"CVE-2026-0626","description":"The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads \u0026 Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-04T12:16:02.787Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:13.1424Z"}]}}