CVE-2026-57816
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Funnel Builder plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into HTTP request parameters, which will be executed in the victim's browser.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or other actions performed in the context of an administrator session. This attack could lead to full compromise of the WordPress site.
Recommendation
Immediately update the Funnel Builder plugin to version 3.15.0.9 or later, which includes a fix for this vulnerability. Until the update is applied, restrict access to the admin panel and use a Web Application Firewall (WAF).
Other vulnerabilities in Funnel Builder by FunnelKit
See all- CVE-2026-42381Critical
There is an unauthenticated SQL injection vulnerability in Funnel Builder by FunnelKit versions up to 3.15.0.1.
- CVE-2026-48966High
Versions of Funnel Builder by FunnelKit up to 3.15.0.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.