WPFunnels <= 3.13.1 - Reflected Cross-Site Scripting via 'per_page' Parameter
- ID
- WPSEC-2026-0174
- Plugin
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (wpfunnels)
- Affected
- from 2.8.0 before 3.13.2
- Remediation
- Update to 3.13.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WPFunnels on WPSec AttackSurface
- Fix released
- Published
Description
The WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'per_page' parameter of the funnel list admin page in versions 2.8.0 up to, and including, 3.13.1. This is due to the value being passed only through sanitize_text_field(), which does not encode quotes, and then echoed unescaped into the href attribute of the pagination links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a user's browser if they can trick a user with access to the funnel list, such as an administrator, into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0174/
- https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.2/
- https://wordpress.org/plugins/wpfunnels/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS