What’s Vulnerable › Vulnerabilities

CVE-2021-24330: Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-01 · updated 2026-06-17
• Weakness: CWE-79

Description

The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.

Affected products

• brainstormforce CartFlows – Funnel Builder & Checkout Plugin for WooCommerce: before 1.6.13 — fixed in 1.6.13

How to fix

Upgrade to a fixed version: brainstormforce CartFlows – Funnel Builder & Checkout Plugin for WooCommerce 1.6.13. Check the vendor advisory for mitigations.

References

• https://m0ze.ru/vulnerability/%5B2021-04-26%5D-%5BWordPress%5D-%5BCWE-79%5D-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt
• https://wpscan.com/vulnerability/b9748066-83b7-4762-9124-de021f687477
• https://m0ze.ru/vulnerability/%5B2021-04-26%5D-%5BWordPress%5D-%5BCWE-79%5D-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt
• https://wpscan.com/vulnerability/b9748066-83b7-4762-9124-de021f687477

Get alerted when CVE-2021-24330 or the next vulnerability affects your stack