A vulnerability classified as problematic was found in getwpfunnels WPFunnels Plugin up to 3.7.9 on WordPress. This impacts the function
wpf_optin_form of the component Shortcode Handler. The manipulation of the argument button_icon results in cross site scripting.
This vulnerability is known as CVE-2026-0626. It is possible to launch the attack remotely. No exploit is available.
