Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-04 | 1 | General1 |
| 2026-04-11 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-0626-wpfunnels-version-3-7-9-medium-vulnerability-proof-of-concept CVE-2026-0626 #WordPress plugin #vulnerability wpfunnels #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof-of-concept for CVE‑2026‑0626 in WP Funnels 3.7.9 is available via a linked page, with no claims of exploitation, patch, or detailed technical description.
CVE-2026-0626 The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf… https://www.cve.org/CVERecord?id=CVE-2026-0626
Post summary
The text reports a stored XSS vulnerability in the WPFunnels WordPress plugin, but provides no information on exploits, patches, or active exploitation.