7.1
Élevée
CVE-2026-12978 The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into…
Description
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| FunnelKit 3.15 | premières → < 3.15.0.6 | 3.15.0.6 |
Autres CVE de FunnelKit
Les 4 CVE de FunnelKit →
CVE-2026-12979
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a…
5.5
Moyenne
CVE-2025-10567
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its…
6.3
Moyenne
CVE-2025-2203
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL…
6.1
Moyenne