CVE-2026-12978

HIGH

FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form

Title source: cna
STIX 2.1

Description

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/1b22645b-28cb-44f3-a5b9-c81a40175e59/

Scores

CVSS v3 7.1
EPSS 0.0016
EPSS Percentile 6.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
None/FunnelKit < 3.15.0.6
Published Jul 16, 2026
Tracked Since Jul 16, 2026