What is the CVSS score of CVE-2026-12978?

CVE-2026-12978 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of FunnelKit are affected by CVE-2026-12978?

FunnelKit WordPress plugin versions before 3.15.0.6 contain a reflected cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious JavaScript into page-builder AJAX…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12978?

Yes, a public proof-of-concept exploit is available for CVE-2026-12978. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12978?

Within 24 hours: Inventory all WordPress installations using FunnelKit, determine current versions and Divi integration status, and prioritize customer-facing or administrative sites. Within 7 days: Deploy FunnelKit 3.15.0.6 or later across all affected installations, testing in staging environments first to verify Divi page-builder compatibility. Within 30 days: Audit affected site logs and WordPress audit trails for exploitation indicators or unauthorized script injection; escalate any evidence of compromise to incident response teams for forensic analysis and account remediation.

FunnelKit CVE-2026-12978

EUVD-2026-44881 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 WPScan

GHSA-j8mc-rrx2-537q

WordPress XSS Funnelkit Unknown

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated reflected XSS (PR:N) needs victim interaction (UI:R) and crosses into the browser context (S:C) with low confidentiality/integrity impact; no genuine availability impact so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 13:23 vuln.today

CVSS changed

Jul 16, 2026 - 13:22 NVD

7.1 (HIGH)

Patch available

Jul 16, 2026 - 10:18 EUVD

CVE Published

Jul 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 16, 2026 - 06:00 cve.org

HIGH 7.1

DescriptionCVE.org

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.

AnalysisAI

Reflected Cross-Site Scripting in the FunnelKit WordPress plugin before 3.15.0.6 lets unauthenticated attackers inject arbitrary JavaScript into a page-builder AJAX response, which executes in the browser of a logged-in user who opens an attacker-crafted link. The flaw is only reachable when the Divi builder integration is active, and publicly available exploit code exists though there is no public exploit identified as actively exploited at time of analysis. EPSS was not provided and the vulnerability is not on CISA KEV, so widespread exploitation is unconfirmed.

Technical ContextAI

FunnelKit (formerly WooFunnels) is a WordPress sales-funnel and checkout-optimization plugin that integrates with page builders including Divi. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS: one of the plugin's page-builder AJAX actions echoes a user-supplied request parameter directly into the HTML response without output escaping or encoding. Because the vulnerable AJAX handler is only registered when the Divi builder is active, the attack surface is conditional on that specific integration being enabled. The CPE data (cpe:2.3:a:unknown:funnelkit:funnelkit) confirms the affected component is the FunnelKit application itself rather than a bundled third-party library.

RemediationAI

Vendor-released patch: upgrade FunnelKit to version 3.15.0.6 or later, which is the primary and definitive fix per the vendor advisory referenced by WPScan (https://wpscan.com/vulnerability/1b22645b-28cb-44f3-a5b9-c81a40175e59/). If immediate patching is not possible, a targeted compensating control is to deactivate the Divi builder integration, since the vulnerable AJAX action is only registered when Divi is active - this closes the attack surface entirely but disables Divi-based page editing for the site. Alternatively, deploy a web application firewall rule to block or sanitize requests to the affected FunnelKit page-builder AJAX action containing HTML/script metacharacters in the reflected parameter, accepting the trade-off that WAF signatures can be bypassed by encoding and may cause false positives on legitimate builder traffic. Restricting admin/editor access and advising privileged users not to open untrusted links reduces, but does not eliminate, the chance a crafted page triggers the payload.