What is the CVSS score of CVE-2026-57374?

CVE-2026-57374 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Funnel Builder Pro are affected by CVE-2026-57374?

Funnel Kit Funnel Builder PRO (WordPress plugin versions ≤3.15.0.7) contains an unauthenticated reflected cross-site scripting vulnerability (CVE-2026-57374, CVSS 7.1) that enables attackers to…

How to fix or mitigate CVE-2026-57374?

Within 24 hours, audit all WordPress instances to identify Funnel Kit Funnel Builder PRO installations and current versions, then contact vendor Wisetr Inc. to confirm patch status and timeline. Within 7 days, deploy compensating controls: disable the plugin if not mission-critical, implement Web Application Firewall rules to block XSS injection patterns in Funnel Builder inputs, enforce Content Security Policy headers restricting inline script execution, and restrict plugin access to pre-approved administrators. Within 30 days, establish a weekly patch monitoring process with the vendor and security channels; immediately test and deploy a patched version upon its release, validating in staging before production rollout.

Funnel Builder Pro CVE-2026-57374

EUVD-2026-48165 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-7w9g-8ww7-6pcg

WordPress XSS Wordpress Plugin Funnel Kit Funnel Builder Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated reflected XSS is network-reachable (AV:N, PR:N) but needs victim interaction (UI:R); injected script crosses into the site origin (S:C) with bounded Low impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:18 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.

AnalysisAI

Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.

Technical ContextAI

Funnel Kit (formerly WooFunnels) Funnel Builder is a WordPress plugin used to build sales funnels, checkout flows, and landing pages; the PRO tier (CPE cpe:2.3:a:wisetr_inc.:funnel_kit_funnel_builder_pro) is the affected component. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected into an HTML/JS response without adequate output encoding or input sanitization. Because it is flagged unauthenticated with UI required and a changed scope, the injection point is almost certainly a front-end/reflected parameter processed by the plugin and rendered back into a page served in the WordPress site's origin.

RemediationAI

Upgrade Funnel Kit Funnel Builder PRO to a release newer than 3.15.0.7; a fixed version above 3.15.0.7 is implied by the affected range but the exact patched version number is not stated in the available data, so confirm the current version via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/funnel-builder-pro/vulnerability/wordpress-funnel-kit-funnel-builder-pro-plugin-3-15-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve) and the vendor changelog before deploying. Until patched, apply a WAF or virtual patch (Patchstack provides one) with rules that strip or encode script-like payloads on the plugin's request parameters, and add a restrictive Content-Security-Policy to limit inline/injected script execution - noting that a strict CSP can break legitimate inline scripts on funnel pages and should be tested in report-only mode first. Restricting or monitoring access to the plugin's public funnel endpoints reduces exposure but may not be feasible for pages that must remain public-facing.