CVE-2026-48966: WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.2 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the Funnel Builder by FunnelKit WordPress plugin, affecting all versions up to and including 3.15.0.2. The flaw is reachable over the network without any login or prior account, but requires a victim to interact with a crafted link or page (for example, by clicking a malicious URL). Successful exploitation lets an attacker inject and execute arbitrary JavaScript in the victim's browser, enabling session hijacking, page content manipulation, or redirection to attacker-controlled sites. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress site's HTTP/HTTPS service to deliver a malicious payload.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerability is exploitable by any unauthenticated visitor.

• Victim interactionRequired

  A victim must take an action such as clicking a crafted link or visiting a page containing the injected payload for the JavaScript to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Attacker executes arbitrary JavaScript in the authenticated victim's browser session, enabling theft of session cookies or authentication tokens.
• Attacker can read or exfiltrate page content visible to the victim, including any sensitive data rendered in the WordPress admin or front-end context.
• Attacker can modify what the victim sees on the page, such as injecting phishing forms or redirecting the browser to an attacker-controlled site.
• The CVSS scope is changed (S:C), meaning impact can extend beyond the vulnerable plugin itself to other browser-origin resources the victim has access to.