CVE-2026-12978 Overview
CVE-2026-12978 is a Reflected Cross-Site Scripting (XSS) vulnerability in the FunnelKit WordPress plugin before version 3.15.0.6. The plugin fails to escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions. The affected action is only registered when the Divi Builder is active, which narrows the attack surface to sites running both plugins. Unauthenticated attackers can craft a malicious URL that, when opened by a logged-in user, executes arbitrary JavaScript in the victim's browser session. The vulnerability is tracked under CWE-79 and carries a CVSS 3.1 base score of 7.1.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of authenticated WordPress users, potentially hijacking sessions or performing privileged actions on their behalf.
Affected Products
- FunnelKit WordPress plugin versions prior to 3.15.0.6
- WordPress installations that also have the Divi Builder active
- Any site exposing the vulnerable page-builder AJAX action to unauthenticated requests
Discovery Timeline
- 2026-07-16 - CVE-2026-12978 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-12978
Vulnerability Analysis
The vulnerability resides in a page-builder AJAX action exposed by the FunnelKit plugin. The handler accepts a parameter supplied by the requester and echoes it back inside the HTML response without applying output escaping. Because the action is reachable without authentication, any remote attacker can trigger the reflection path. When a logged-in WordPress user opens a crafted link, the injected markup renders in the response body and executes in the user's browser context. The impact scope changes because the injected script runs against the authenticated session, granting the attacker access to the victim's WordPress permissions.
Root Cause
The root cause is missing output escaping on user-controlled input in an AJAX endpoint registered by FunnelKit's Divi integration. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for safely rendering user input, but the vulnerable handler reflects the parameter directly into HTML. This falls under improper neutralization of input during web page generation [CWE-79].
Attack Vector
Attackers craft a URL targeting the vulnerable AJAX action with a malicious payload placed in the reflected parameter. The attacker then delivers the URL to a logged-in WordPress user through phishing, forum posts, or third-party sites. When the victim loads the URL, the browser executes the attacker's JavaScript within the WordPress origin. The action is only registered when the Divi Builder is active, so exploitation requires the target site to have both FunnelKit and Divi enabled. User interaction is required, and the attacker cannot execute the payload without a victim clicking the crafted link.
No verified public exploit code is available. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-12978
Indicators of Compromise
- HTTP requests to FunnelKit page-builder AJAX endpoints containing HTML or JavaScript syntax such as <script>, onerror=, or javascript: in query parameters
- Referrer headers pointing to untrusted external domains preceding requests to admin-ajax.php with FunnelKit actions
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links
Detection Strategies
- Inspect web server access logs for requests to FunnelKit AJAX actions with URL-encoded angle brackets, event handlers, or script tags in parameter values
- Deploy a web application firewall rule to flag reflected XSS patterns in requests targeting admin-ajax.php when the action parameter matches FunnelKit page-builder endpoints
- Correlate authenticated admin sessions with anomalous JavaScript execution or DOM modifications reported by browser-based endpoint telemetry
Monitoring Recommendations
- Alert on any FunnelKit plugin version below 3.15.0.6 discovered during asset inventory scans of WordPress sites
- Monitor for combined installation of FunnelKit and Divi Builder, which represents the exploitable configuration
- Track session hijacking indicators such as new administrator accounts, unexpected plugin installations, or unauthorized content changes following user-clicked external links
How to Mitigate CVE-2026-12978
Immediate Actions Required
- Update the FunnelKit WordPress plugin to version 3.15.0.6 or later on all affected sites
- Audit administrator and editor accounts for unauthorized changes made since the plugin became vulnerable
- Educate privileged WordPress users to avoid clicking untrusted links while logged into the site
Patch Information
The vendor addressed the flaw in FunnelKit version 3.15.0.6 by applying proper output escaping to the reflected parameter. Site owners should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Deactivate the FunnelKit plugin until patching is possible if the site cannot be updated immediately
- Deactivate the Divi Builder plugin, since the vulnerable AJAX action is only registered when Divi is active
- Deploy a web application firewall rule that blocks requests to FunnelKit AJAX actions containing HTML tags or JavaScript event handlers in parameters
# Example WAF rule pattern to block reflected XSS payloads targeting the vulnerable action
# ModSecurity-style rule
SecRule ARGS:action "@rx funnelkit_.*builder" \
"chain,deny,status:403,id:1029780,msg:'Block reflected XSS in FunnelKit AJAX (CVE-2026-12978)'"
SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
