CVE-2026-97271: WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPFunnels pluginto a version that resolves this vulnerability.Fixed in 3.13.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
The issue is described as unauthenticated XSS, so an attacker does not need a WPFunnels account or prior authentication to attempt exploitation. User interaction is required according to the supplied vector.
Which installations are affected?
WPFunnels versions 3.13.1 and earlier are identified as affected. The provided data does not state whether a particular WordPress or WPFunnels configuration is required.
What is the potential impact?
The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful XSS could execute attacker-controlled script in a victim's browser context.