CVE-2026-12978

HighCVSS 7.1

Published: 16/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

The FunnelKit WordPress plugin before version 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.

Risk Assessment

The risk involves the execution of arbitrary JavaScript code in the browser of a logged-in administrator or editor, potentially leading to session theft, account takeover, or content modification.

Recommendation

Immediately update the FunnelKit plugin to version 3.15.0.6 or later. If an update is not possible, temporarily disable the Divi /builder or restrict access to the admin panel.

Other vulnerabilities in FunnelKit

CVE-2026-12979Medium
The FunnelKit WordPress plugin before version 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation. This allows users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, potentially disabling other FunnelKit plugin functions (denial of service).

Original NVD description (English source)

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.