CVE-2026-12978 – FunnelKit < 3.15.0.6 – Reflected XSS via Divi Optin Form

CVE ID :CVE-2026-12978

Published : July 16, 2026, 7:16 a.m. | 18 minutes ago

Description :The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…