What is the CVSS score of CVE-2026-57373?

CVE-2026-57373 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

FunnelKit Funnel Builder Pro CVE-2026-57373

EUVD-2026-48164 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-x9p9-vmvc-5jr4

WordPress XSS Wordpress Plugin Funnel Kit Funnel Builder Pro

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Retains AV:N, AC:L, PR:L, UI:R, S:C, C:L, I:L from vendor vector; sets A:N as XSS does not directly cause availability impact on the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:05 vuln.today

DescriptionCVE.org

Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.

AnalysisAI

Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.

Technical ContextAI

FunnelKit Funnel Builder PRO (CPE: cpe:2.3:a:wisetr_inc.:funnel_kit_funnel_builder_pro:*:*:*:*:*:*:*:*) is a commercial WordPress plugin by WiseTR Inc. that enables WooCommerce store operators to build sales funnels, checkout pages, upsells, and order bumps. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning user-supplied input is reflected or stored without adequate output encoding or sanitization before being rendered in a browser. The 'Customer XSS' labeling in the CVE description, combined with PR:L in the CVSS vector, indicates the injection point is accessible to customer-tier WordPress accounts - the lowest authenticated role common to WooCommerce stores - rather than requiring editor or administrator privileges. The S:C (Scope Changed) metric confirms the injected content executes in a different security principal's browser context, crossing the trust boundary from the injecting customer to a victim user (potentially an administrator).

RemediationAI

Update the FunnelKit Funnel Builder PRO plugin to the version released after 3.15.0.4; the exact patched version number should be confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/funnel-builder-pro/vulnerability/wordpress-funnel-kit-funnel-builder-pro-plugin-3-15-0-4-cross-site-scripting-xss-vulnerability or the WordPress plugin repository changelog. Patch available per vendor advisory - exact fix version not independently confirmed from available input data. As a compensating control prior to patching, restrict customer registration if not required by the store, or audit and limit which customer-facing input fields (order notes, custom fields, funnel form entries) are rendered to admin users without sanitization. Implementing a strict Content Security Policy (CSP) header that blocks inline script execution can limit XSS impact but may interfere with legitimate funnel JavaScript functionality - test thoroughly before deploying.