The FunnelCockpit plugin for WordPress contains an improper neutralization of input during web page generation that allows attackers to inject arbitrary HTML or JavaScript into reflected responses. This vulnerability, classified as CWE‑79, leads to Reflected Cross‑Site Scripting. Based on the description, it is inferred that any user‑supplied input that is reflected directly in the page can be exploited to inject malicious payloads, potentially enabling attackers to steal session cookies, hijack accounts, deface pages, or deliver phishing content to users who visit crafted URLs.

WordPress installations running FunnelCockpit plugin version 1.4.3 or earlier are affected. The flaw is present in all releases from the earliest documented version up to and including 1.4.3.

The CVSS score of 7.1 indicates a high severity level, while the EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low. Based on the description, it is inferred that the vulnerability can be triggered by any external user who can influence a request to the plugin, such as clicking a specially crafted link or submitting a form that passes data to an endpoint that reflects it back. The flaw can therefore be exploited via arbitrary URLs or input fields that the plugin retains. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation campaigns, but the existence of the flaw warrants timely remediation.