{"id":"CVE-2026-12978","aliases":["EUVD-2026-44881","GHSA-j8mc-rrx2-537q"],"status":"published","title":"FunnelKit \u003c 3.15.0.6 - Reflected XSS via Divi Optin Form","description":"The FunnelKit  WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00282,"percentile":0.20829,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-07-16T06:00:04Z","modified":"2026-07-16T15:34:12Z","products":[{"vendor":"unknown","product":"funnelkit"}],"references":[{"url":"https://wpscan.com/vulnerability/1b22645b-28cb-44f3-a5b9-c81a40175e59/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12978"},{"url":"https://wpscan.com/vulnerability/1b22645b-28cb-44f3-a5b9-c81a40175e59"},{"url":"https://github.com/advisories/GHSA-j8mc-rrx2-537q"}],"sources":{"cve":[{"id":"CVE-2026-12978","title":"FunnelKit \u003c 3.15.0.6 - Reflected XSS via Divi Optin Form","description":"The FunnelKit  WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.","status":"published","published":"2026-07-16T06:00:04.896Z","modified":"2026-07-16T12:42:59.445Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-44881","description":"The FunnelKit  WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.","status":"published","published":"2026-07-16T06:00:04Z","modified":"2026-07-16T12:42:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:51.881225Z"}],"ghsa":[{"id":"GHSA-j8mc-rrx2-537q","title":"The FunnelKit  WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before...","description":"The FunnelKit  WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.","status":"published","published":"2026-07-16T09:32:17Z","modified":"2026-07-16T15:34:12Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:33.90316Z"}],"nvd":[{"id":"CVE-2026-12978","description":"The FunnelKit  WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.","status":"published","published":"2026-07-16T07:16:47.577Z","modified":"2026-07-16T13:43:05.487Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:30.250437Z"}]}}