CVE-2025-54696: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the WPFunnels WordPress plugin, identified as CVE-2025-54696. The vulnerability affects versions up to and including 3.5.26 of the WPFunnels plugin. The issue was discovered by security researcher Denver Jackson and was publicly disclosed on July 30, 2025 (Rapid7, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue stems from insufficient input sanitization and output escaping in the WPFunnels plugin (NVD, Patchstack).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions, data theft, or site defacement (Rapid7).

The vulnerability has been patched in version 3.5.27 of the WPFunnels plugin. Users are advised to update to this version or later to remediate the security issue. The fix addresses the input sanitization and output escaping weaknesses present in earlier versions (Patchstack).