CVE-2025-30631

CVE-2025-30631 is a Reflected XSS in AA-Team Woocommerce Sales Funnel Builder and AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer). Affected: Woocommerce Sales Funnel Builder up to version 1.1; Amazon Affiliates Addon for WPBakery Page Builder up to 1.2. Root c...

WordPress plugin Woocommerce Sales Funnel Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripti...

CVE-2025-30631: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder formerly Visual Composer allows Reflected XSS.This issue affects Woocommerce Sales Funnel Builder...

CVE-2023-37977: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin = 2.7.16 versions...

Cross site scripting

The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

PT-2023-16059

Name of the Vulnerable Software and Affected Versions Drag & Drop Sales Funnel Builder for WordPress versions prior to 2.6.9 Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and escape som...

CVE-2023-0173: Undefined Security Weakness

The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...