FunnelKit CVE-2026-12978

Exploitation requires the Divi builder to be active on the target WordPress site, because the vulnerable page-builder AJAX action is only registered under that condition - sites running FunnelKit without Divi are not exploitable. The attacker needs no authentication (PR:N), but success depends on a logged-in user (typically an administrator or editor with access to the builder) clicking or opening the attacker-crafted page/link (UI:R). Limiting factors are therefore: the required Divi integration (non-default for many installs), the need for a valid authenticated victim session to make the reflected payload impactful, and the requirement for victim interaction - reducing viability against sites that lack Divi or whose privileged users do not open untrusted links.

The CVSS 3.1 base score is 7.1 (High) driven largely by the scope change (S:C) and network vector, but real-world risk is moderated by several factors. Exploitation requires user interaction (UI:R) - a logged-in user must open a crafted link - and confidentiality, integrity and availability impacts are each only Low (C:L/I:L/A:L), consistent with reflected XSS rather than direct server compromise. Privileges are none (PR:N) so the attacker needs no account, but the vulnerable code path only exists when the Divi builder is active, which meaningfully narrows the exploitable population. Publicly available exploit code raises the practical likelihood of opportunistic use, but no EPSS score was supplied and the CVE is not KEV-listed, so there is no evidence of active or automated exploitation - treat this as a real but conditional priority, prioritized higher for sites known to run Divi alongside FunnelKit.

An attacker crafts a URL to the FunnelKit Divi page-builder AJAX endpoint embedding a malicious script in the vulnerable parameter and sends it to a WordPress administrator or editor (e.g., via phishing email or a comment). When the logged-in user opens the link, the unescaped parameter is reflected into the HTML response and the script executes in their authenticated session, enabling session/cookie theft or actions performed as that user. Publicly available exploit code lowers the effort required to weaponize this against a targeted victim.