PT-2026-50341 · Wpfunnels+1 · Wpfunnels Pro

Dutafi

·

CVE-2026-49778

·

Published

2026-06-04

·

Updated

2026-06-17

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions WPFunnels Pro versions prior to 2.9.5
Description The WPFunnels Pro plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This issue occurs because of insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically whenever a user visits the affected page.
Recommendations Update to a version newer than 2.9.4.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-49778

Affected Products

Wpfunnels Pro