CVE-2026-42381
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
There is an unauthenticated SQL injection vulnerability in Funnel Builder by FunnelKit versions up to 3.15.0.1.
Risk Assessment
An attacker could exploit this vulnerability to gain access to database data, potentially leading to information leakage or system compromise.
Recommendation
It is recommended to upgrade to the latest version of Funnel Builder to mitigate this vulnerability.
Other vulnerabilities in Funnel Builder by FunnelKit
See all- CVE-2026-57816High
The Funnel Builder plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into HTTP request parameters, which will be executed in the victim's browser.
- CVE-2026-48966High
Versions of Funnel Builder by FunnelKit up to 3.15.0.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS