# CVE-2026-57816: FunnelKit Funnel Builder Reflected XSS

Source: https://junglewise.ai/threats/cve-2026-57816-funnelkit-funnel-builder-reflected-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-57816 · Severity: high · CVSS 7.1 · Published 2026-07-13

Funnel Builder by FunnelKit is a WordPress plugin used to create sales funnels and marketing pages. A security vulnerability in this plugin allows attackers to inject malicious scripts into the website, which are then executed in the browser of other users. If a site administrator or customer clicks a specially crafted link, the attacker could potentially steal session information, redirect users to malicious sites, or perform unauthorized actions on their behalf.

Technologies: [FunnelKit Funnel Builder](https://junglewise.ai/threats/technologies/funnel-builder). Vendors: [FunnelKit](https://junglewise.ai/threats/vendors/funnelkit).

## Quick answers

**Is CVE-2026-57816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57816 being exploited in the wild.

**How severe is CVE-2026-57816?** High severity, with a CVSS score of 7.1, published 13 July 2026.

**Which products and versions are affected?** FunnelKit Funnel Builder <= 3.15.0.8.

**Is there a fix for CVE-2026-57816?** A patch was published on 2026-07-10: Version 3.15.0.9 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57816 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57816?** Check whether you run FunnelKit Funnel Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Funnel Builder by FunnelKit plugin for WordPress (versions up to and including 3.15.0.8) is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on web page generation. An unauthenticated remote attacker can exploit this by tricking a user into clicking a crafted link or visiting a malicious page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.1, as it requires user interaction but can lead to a full compromise of the user's browser session within the application's context. The issue is resolved in version 3.15.0.9.

## Affected products

- FunnelKit Funnel Builder by FunnelKit <= 3.15.0.8

## Timeline

- 2026-06-25: disclosed: Reported by daroo to Patchstack
- 2026-07-10: advisory: Patchstack advisory published
- 2026-07-13: advisory: NVD record published
- 2026-07-10: patched: Version 3.15.0.9 released to address the issue

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-15-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-15-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [FunnelKit WordPress plugin arbitrary file deletion in template importer](https://junglewise.ai/threats/cve-2026-12979-funnelkit-wordpress-plugin-arbitrary-file-deletion-in-template)
- [FunnelKit WordPress plugin reflected XSS in Divi Optin Form](https://junglewise.ai/threats/cve-2026-12978-funnelkit-wordpress-plugin-reflected-xss-in-divi-optin-form)
- [FunnelKit Funnel Builder SQL injection](https://junglewise.ai/threats/cve-2026-56052-funnelkit-funnel-builder-sql-injection)
- [FunnelKit Funnel Builder unauthenticated XSS](https://junglewise.ai/threats/cve-2026-48966-funnelkit-funnel-builder-unauthenticated-xss)
- [FunnelKit Funnel Builder unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-42381-funnelkit-funnel-builder-unauthenticated-sql-injection)