CVE-2026-49778: WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability exists in the WPFunnels Pro WordPress plugin at version 2.9.4 and earlier. The vulnerability is reachable over the network without any authentication, but requires a victim to interact with a crafted link or page. Successful exploitation lets an attacker inject and run arbitrary JavaScript in the victim's browser, enabling session theft, page content manipulation, and denial of service against the affected WordPress site. HarborGuard is tracking this advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable WordPress site over the network; the service must be exposed to the attacker's origin.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated party.

• Victim interactionRequired

  A victim must follow a crafted link or visit a malicious page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions or race-condition requirements on the attacker.

Blast Radius

• An attacker can inject JavaScript that runs in the victim's browser session and reads stored session cookies or authentication tokens, enabling account takeover.
• Injected scripts can silently modify visible page content, redirect the victim to a phishing site, or perform actions on the WordPress admin panel on the victim's behalf.
• With a scope change confirmed in the CVSS vector, the impact escapes the plugin's own context and can affect the broader WordPress application and any co-hosted resources the victim's browser session can reach.
• The availability impact allows the attacker to degrade or disrupt the victim's interaction with the affected WordPress site through browser-side denial of service techniques.