CVE-2026-48966
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Versions of Funnel Builder by FunnelKit up to 3.15.0.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Risk Assessment
This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the application's security and its users.
Recommendation
It is recommended to update Funnel Builder to the latest version to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in Funnel Builder by FunnelKit
See all- CVE-2026-42381Critical
There is an unauthenticated SQL injection vulnerability in Funnel Builder by FunnelKit versions up to 3.15.0.1.
- CVE-2026-57816High
The Funnel Builder plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into HTTP request parameters, which will be executed in the victim's browser.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.