CVE-2026-57374

The Funnel Kit Funnel Builder PRO plugin version 3.15.0.7 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. The attack does not require authentication, increasing the attack surface.

Immediately update the Funnel Kit Funnel Builder PRO plugin to the latest available version. Also consider deploying a Web Application Firewall (WAF) to block common XSS patterns.