Funnel Builder by FunnelKit CVE-2026-48966

Exploitation requires the target WordPress site to have the Funnel Builder by FunnelKit plugin installed at version 3.15.0.2 or earlier and reachable over the network, and requires a victim user to interact with an attacker-supplied link or input (UI:R in the CVSS vector). No authentication is required of the attacker (PR:N), but the impact escalates significantly when the victim is an authenticated WordPress user - particularly an administrator or shop manager - whose session the script can leverage. The scope change (S:C) indicates the injected script executes in the WordPress site origin rather than the attacker's origin, which is the standard behavior for XSS against the hosting application.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network reachability, low complexity, no authentication, but required user interaction with a scope change - typical of reflected XSS where a victim clicks a crafted link and the payload executes in the WordPress site's origin. EPSS data was not provided in the input, and the CVE is not on CISA KEV, so there is no signal of active exploitation. No public POC was identified at time of analysis. Real-world risk is moderate: while exploitation is unauthenticated and network-based, it requires luring a victim (likely an administrator or shop manager for highest impact) to click a malicious link, which limits mass exploitation. Priority should be elevated on WordPress sites where the plugin is installed and admins are reachable via phishing.

An attacker crafts a URL or form submission targeting a vulnerable Funnel Builder endpoint on a WordPress site with the plugin installed and sends it to a site administrator or visitor via phishing. When the victim clicks the link, the injected JavaScript executes in the WordPress origin, allowing the attacker to steal session cookies, perform actions as the victim (such as creating admin users if the victim is an administrator), or redirect to attacker-controlled content.