WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

LLM-synthesized narrative grounded in this CVE's description and references.

• WordPress/WPFunnels Prollm-create

  Range: <=2.9.4

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

• patchstack.com/database/wordpress/plugin/wpfunnels-pro/vulnerability/wordpress-wpfunnels-pro-plugin-2-9-4-cross-site-scripting-xss-vulnerabilitymitrevdb-entry

• Wordfence Intelligence Weekly WordPress Vulnerability Report (June 1, 2026 to June 7, 2026)
  Wordfence Blog · Jun 11, 2026