The Funnelforms Free plugin for WordPress contains a DOM-based Cross‑Site Scripting flaw caused by improper neutralization of user supplied input. When the plugin incorporates user data into web pages without adequate sanitization, an attacker can inject malicious JavaScript, potentially stealing session cookies, defacing the site, or delivering phishing attacks. This is a classic CWE‑79 vulnerability that directly affects the integrity and confidentiality of the site’s occupants.

All WordPress installations that use the Funnelforms Free plugin version 3.8 or earlier are vulnerable. The affected product is the Funnelforms Free add‑on released by Funnelforms; no sub‑version details beyond the <=3.8 boundary are supplied.

The CVSS score of 6.5 classifies the issue as moderate severity. The EPSS score of less than 1% indicates that while the flaw exists, widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by crafting URLs or form inputs that are reflected into the page DOM. Once the script runs in a victim’s browser, it can intercept credentials or perform other malicious actions. Thus, the risk is non‑negligible and mitigation is advised promptly.