Funnel Kit Funnel Builder Pro
Monthly
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.