CVE-2026-57373

MediumCVSS 6.5

Published: 23/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Funnel Kit Funnel Builder PRO plugin version 3.15.0.4 and earlier is vulnerable to Cross Site Scripting (XSS) from a customer level. A customer can inject malicious script.

Risk Assessment

The organization is at risk of customer session theft, website defacement, or theft of sales data.

Recommendation

Update the Funnel Kit Funnel Builder PRO plugin to a version newer than 3.15.0.4.

Other vulnerabilities in Funnel Kit Funnel Builder PRO

CVE-2026-57374High
The Funnel Kit Funnel Builder PRO plugin version 3.15.0.7 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Original NVD description (English source)

Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS