Improper neutralization of input during web page generation allows stored cross‑site scripting. An attacker can inject malicious JavaScript that executes in the browsers of visitors, leading to credential theft, session hijacking, defacement or further attacks against other users. The weakness corresponds to CWE‑79 and can compromise the confidentiality, integrity, and availability of the affected WordPress site.

The vulnerability is present in the WPFunnels plugin provided by the WPFunnels Team. Any installation of the plugin with a version up to and including 3.13.3 is affected. Users on WordPress sites who have installed this plugin and have not applied a patch are vulnerable, regardless of their specific WordPress version.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available, so the probability of exploitation cannot be quantified from this metric. The vulnerability is not listed in the CISA KEV catalog. It most likely can be exploited remotely by any visitor who can influence data stored via the plugin, such as through form inputs or post content. If successful, the attacker can execute arbitrary JavaScript in the context of any site visitor.