The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject arbitrary scripts into the web pages generated by the WPFunnels plugin. Because the malicious payload is persisted in the database, any visitor to the compromised page will execute the script, potentially leading to session hijacking, cookie theft, or forwarding the user to malicious sites. The flaw resides in the improper neutralization of input during page generation and is classified as CWE‑79.

WordPress sites running the WPFunnels plugin version 3.5.26 or earlier are impacted. The flaw applies to all releases from the plugin’s initial version through 3.5.26, affecting any WordPress installation that has not been upgraded past that point.

The CVSS score of 6.5 indicates a medium‑severity risk. The EPSS score of less than 1% suggests a low probability of widespread exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the attacker to submit input through the plugin’s interface that is stored and later served back to users, so access to the plugin’s data entry pages is needed. The impact, once successful, is that all site visitors who load the affected page will be exposed to the injected script; this inference is drawn from the stored XSS nature of the flaw.