The FunnelCockpit WordPress plugin contains a reflected XSS flaw due to the unsanitized handling of the error parameter, which can be reflected in the page output. If an attacker can trick an administrative user into visiting a crafted URL containing the error value, the script will run in the admin’s browser, potentially stealing session cookies, defacing sites, or executing further attacks. The weakness is a classic input validation error (CWE‑79).

All installations of the FunnelCockpit plugin for WordPress up to version 1.4.3 are affected. Users should verify whether their deployment is running any of these releases and plan an upgrade to a fixed version.

The CVSS score of 6.1 indicates a medium severity vulnerability, and the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but since it relies on social engineering to target administrators it can still pose a significant risk. The probable attack vector is an unauthenticated attacker sending a malicious link to a privileged user who follows it, leading to the execution of arbitrary client‑side code.