What is the CVSS score of CVE-2026-57816?

CVE-2026-57816 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of FunnelKit Funnel Builder are affected by CVE-2026-57816?

FunnelKit Funnel Builder WordPress plugin versions 3.15.0.8 and earlier contain a reflected cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious JavaScript that…

How to fix or mitigate CVE-2026-57816?

Within 24 hours: inventory all WordPress instances running FunnelKit Funnel Builder and document installed versions; disable or deactivate the plugin immediately if operationally feasible. Within 7 days: implement Web Application Firewall rules to block XSS payloads targeting FunnelKit endpoints, restrict plugin administrative access by IP address and role, and contact FunnelKit support to confirm patch availability and timeline. Within 30 days: upgrade to the patched version once released by the vendor, conduct security audit of related WordPress plugins for similar vulnerabilities, and validate all instances are updated to the latest secure version.

FunnelKit Funnel Builder CVE-2026-57816

EUVD-2026-43428 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Funnel Builder By Funnelkit Funnelkit

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS is network-delivered with no attacker privileges but needs victim click (UI:R); script escapes the component (S:C) with limited low CIA impact on the browser session.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:24 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.

AnalysisAI

Reflected cross-site scripting in the FunnelKit Funnel Builder WordPress plugin (versions up to and including 3.15.0.8) lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the CVSS vector marks a scope change (S:C), the injected script runs beyond the vulnerable component and can affect the wider WordPress admin/site session context. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Funnel Builder by FunnelKit plugin for WordPress (CPE cpe:2.3:a:funnelkit:funnel_builder_by_funnelkit), a sales-funnel, checkout and automation builder for WooCommerce/WordPress sites. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, in its reflected form: a request parameter is echoed back into an HTTP response without proper output encoding or input sanitization, so attacker-controlled markup is rendered as executable script by the browser. Reflected XSS requires the payload to be delivered per-request (typically via a URL), distinguishing it from stored/persistent XSS.

RemediationAI

No vendor-released patch version is stated in the available data - the record only bounds the vulnerable range at <= 3.15.0.8, so upgrade to the next release above 3.15.0.8 once FunnelKit publishes it and confirm the fixed version against the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-15-0-8-cross-site-scripting-xss-vulnerability) before deploying. Until a fixed release is confirmed, apply compensating controls: deploy a WAF/virtual-patch rule (Patchstack, Wordfence, or equivalent) to filter reflected script payloads on the plugin's endpoints, add a restrictive Content-Security-Policy to limit inline-script execution, and restrict access to funnel/admin pages to trusted IPs - noting that a CSP may break legitimate plugin scripts and IP allow-listing complicates admin access from dynamic addresses. Administrators should also avoid clicking untrusted links to their own site while authenticated.