CVE-2026-62029: WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges (PR:L) and user interaction (UI:R). It is remotely reachable over the network (AV:N) and has low attack complexity (AC:L).
Which installations are affected?
WPFunnels versions through 3.13.3 are affected. The available information does not state whether any particular WordPress or WPFunnels configuration avoids the issue.
What is the potential impact of successful exploitation?
This is a stored XSS issue with low confidentiality, integrity, and availability impact. The scope is changed (S:C), meaning the vulnerable component can affect another security authority.
How can I determine whether my site is affected?
Check whether the site uses the WPFunnels plugin and identify its installed version. Sites running a version at or below 3.13.3 should be treated as affected based on the available version range.