WPFunnels <= 3.13.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Bump Settings
- ID
- WPSEC-2026-0173
- Plugin
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (wpfunnels)
- Affected
- from 2.3.8 before 3.13.2
- Remediation
- Update to 3.13.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WPFunnels on WPSec AttackSurface
- Fix released
- Published
Description
The WPFunnels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order bump settings in versions 2.3.8 up to, and including, 3.13.1. This is due to the block editor preview AJAX actions 'show_checkout_markup' and 'show_lms_checkout_markup' lacking a capability check and nonce verification, while they save the submitted 'order_bump_data' (highlight text, description, checkbox label, image, position and enabled state) into the 'order-bump-settings' meta of any step ID supplied in the request, and to the order bump templates printing those values without output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into a funnel checkout page that already has an order bump configured, which will execute whenever a user accesses that checkout page. Attackers can also change the text and image of, move, or disable existing order bumps.
References
- https://wpsec.com/vuln/WPSEC-2026-0173/
- https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.2/
- https://wordpress.org/plugins/wpfunnels/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS