FunnelKit Funnel Builder CVE-2026-57816

Exploitation requires the FunnelKit Funnel Builder plugin (version <= 3.15.0.8) to be installed and active on the target WordPress site, and - per UI:R in the CVSS vector - requires a victim to actively click or open an attacker-crafted link, so it cannot be triggered silently or server-to-server. No privileges are needed by the attacker to craft the request (PR:N), but the value of the attack depends on the victim being authenticated (ideally an administrator) for the injected script to act on a privileged session; against an anonymous visitor the impact is limited to that visitor's browser. The exact vulnerable parameter/endpoint and whether it is reachable without login are not specified in the available data.

The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): network-reachable, low complexity, no privileges, but requiring user interaction, with only low CIA impact offset by a scope change. This is a moderate, not critical, real-world risk: reflected XSS depends on tricking a specific user (ideally a logged-in admin) into clicking a crafted link, which caps mass-exploitation potential. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or automation - consistent with a typical Patchstack-reported plugin XSS. The main uncertainty is whether the reflected sink is reachable pre-authentication and which endpoint is affected, which the description does not specify; treat this as a standard patch-on-cycle item unless the site has high-value admin sessions.

An attacker crafts a URL to the target WordPress site containing a malicious script payload in a reflected parameter handled by the Funnel Builder plugin, then delivers it to a logged-in administrator via phishing email or a malicious link. When the admin opens the link, the script executes in their authenticated browser session, allowing session/token theft or forced admin actions such as creating a rogue account. No public POC was provided in the input.