PT-2026-60423 · Elegant Themes+1 · Divi+1
CVE-2026-12978
·
Published
2026-07-16
·
Updated
2026-07-16
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
FunnelKit WordPress plugin versions prior to 3.15.0.6
Description
An issue exists where a user-supplied parameter is not properly escaped before being reflected in the HTML response of a page-builder AJAX action. This allows unauthenticated attackers to execute Reflected Cross-Site Scripting (XSS)—a technique where malicious scripts are injected into trusted websites—against logged-in users who visit a specially crafted page. This issue is only present when the Divi /builder is active.
Recommendations
Update FunnelKit WordPress plugin to version 3.15.0.6 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Divi
Funnelkit