CVE-2026-48966: Unauthenticated XSS in Funnel Builder by FunnelKit ≤3.15.0.2

Technical summary

CVE-2026-48966 is an unauthenticated reflected or stored cross-site scripting vulnerability classified under CWE-79. The plugin fails to properly sanitize or escape user-supplied input before rendering it in the web application context. The CVSS 3.1 score of 7.1 (HIGH) reflects network-based attack vector, low complexity, no privilege requirements, and user interaction needed; the impact spans confidentiality, integrity, and availability due to the scope change inherent in XSS payloads that can affect other users or session data.

Business impact

Organizations relying on Funnel Builder for customer acquisition funnels face session hijacking, credential theft, and malware distribution risks. If the vulnerability is exploited at scale—particularly in stored XSS variants—attackers could compromise visitor data, redirect users to phishing sites, or inject skimming code into checkout flows. This directly threatens revenue, customer trust, and regulatory compliance (GDPR, CCPA).

Affected systems

Funnel Builder by FunnelKit plugin versions 3.15.0.2 and earlier running on WordPress installations are vulnerable. Any site using affected versions is at risk. Confirm your installed version in the WordPress plugin admin panel or check your wp-content/plugins/funnelkit-funnel-builder/ directory.

Exploitability

The vulnerability is readily exploitable because it requires no authentication and only user interaction (clicking a link or visiting a page). Attack complexity is low; exploitation does not demand specialized tools or insider knowledge. The lack of CISA KEV designation does not imply this is unexploited in the wild—it indicates CISA has not yet confirmed active exploitation as a widespread threat.

Remediation

Update Funnel Builder by FunnelKit to the latest patched version immediately. Verify the specific patch version against the vendor's official advisory at their WordPress plugin page or security announcement. As an interim measure if patching is delayed, restrict access to funnel-builder pages via .htaccess or Web Application Firewall (WAF) rules that block known malicious payloads.

Patch guidance

Visit the FunnelKit website or the WordPress plugin directory to obtain and apply the latest version that remediates this XSS flaw. Verify against the vendor's official release notes to confirm the patch addresses CVE-2026-48966. Test in a staging environment before production deployment to ensure compatibility with your site's configuration and other plugins.

Detection guidance

Monitor web server and application logs for unusual query parameters or POST data containing script tags, event handlers (onclick, onerror), or JavaScript keywords. Deploy WAF signatures that detect reflected XSS patterns. Use browser developer tools to inspect network requests when testing suspected payloads. Security scanners (e.g., OWASP ZAP, Burp Suite) can identify XSS entry points during vulnerability assessments.

Why prioritize this

HIGH severity rating combined with zero authentication requirement and low attack complexity warrants urgent patching. Unauthenticated XSS in revenue-critical plugin infrastructure poses significant risk to confidentiality and integrity. Although not on CISA's KEV list, the low barrier to exploitation and potential for credential theft or malware distribution justify treating this as a high-priority remediation target.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: network-accessible attack surface (AV:N), simple exploitation (AC:L), no need for attacker privileges (PR:N), requirement for user interaction (UI:R), scope change enabling impact on other users (S:C), and low but non-negligible impact on confidentiality, integrity, and availability (C:L, I:L, A:L). This scoring aligns with the real-world danger of unauthenticated XSS in customer-facing web applications.

Frequently asked questions