LiveActive security incident?Get immediate response
CVE Record

CVE-2021-24330: Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID

The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw affects the CartFlows Funnel Builder WordPress plugin before 1.6.13. A high-privilege logged-in user could save malicious script in tracking ID settings. That script could later run on plugin pages, or potentially across the site depending on configuration.

Executive priority

Treat this as a targeted remediation item, not an emergency based on the provided evidence. Prioritize faster if CartFlows powers revenue pages, checkout funnels, or sites with many privileged users.

Technical view

CVE-2021-24330 is authenticated stored XSS caused by missing sanitization of facebook_pixel_id and google_analytics_id settings. The sources state execution can occur on pages generated by the plugin, or the whole website depending on settings. Evidence indicates a high-privilege prerequisite.

Likely exposure

Exposure is limited to WordPress sites running Funnel Builder by CartFlows before 1.6.13, especially where administrators or similar privileged users can change plugin tracking settings.

Exploitation context

The bundle does not show CISA KEV listing or active exploitation evidence. The attack requires authenticated high-privilege access, but impact can reach visitors or administrators who load affected pages.

Researcher notes

The available evidence names two unsanitized settings and describes stored XSS execution scope. It does not provide CVSS, CPEs, or confirmed exploitation. Validate the affected version boundary carefully because the narrative says before 1.6.13.

Mitigation direction

  • Inventory WordPress sites for the CartFlows Funnel Builder plugin and installed version.
  • Upgrade affected installations to 1.6.13 or later, consistent with the cited affected range.
  • Review vendor guidance before applying compensating controls or cleanup steps.
  • Restrict plugin settings access to trusted administrators only.
  • Review tracking ID settings for unexpected script-like content.

Validation and detection

  • Confirm whether the plugin is installed on each WordPress property.
  • Verify the installed version is 1.6.13 or later.
  • Inspect facebook_pixel_id and google_analytics_id settings for suspicious values.
  • Check affected pages for unexpected script execution indicators.
  • Review administrative account activity around plugin setting changes.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-24330 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
UnknownFunnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress1.6.13Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs