CVE-2026-49778

Versions of WPFunnels Pro up to 2.9.4 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

This vulnerability could lead to user data theft and session hijacking, posing a significant security risk to the organization.

It is recommended to update WPFunnels Pro to the latest version to mitigate this vulnerability and conduct a security audit of the application.