A reflected XSS vulnerability in the FunnelKit WordPress plugin enables unauthenticated attackers to perform malicious actions against authenticated administrative users.

The plugin fails to properly escape user-supplied parameters before reflecting them into the HTML output of AJAX actions, specifically when the Divi builder is active (CWE-79). This allows an unauthenticated attacker to craft a malicious URL that executes arbitrary JavaScript when opened by an authenticated user.

The CVSS score of 7.1 indicates a high severity, primarily due to the potential for session hijacking or unauthorized administrative actions. By tricking an administrator into clicking a malicious link, an attacker can bypass standard security controls, potentially leading to full site compromise, unauthorized configuration changes, or the injection of malicious content into the site.

Immediate Action: Update the FunnelKit WordPress plugin to version 3.15.0.6 or later immediately.

Proactive Monitoring: Review web server access logs for requests containing suspicious script tags or encoded characters within AJAX request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS attack patterns targeting WordPress plugins.

Public Exploit Available: Yes (per public PoC data)

Given the availability of a public proof-of-concept and the ease of exploitation, all users of the FunnelKit plugin must upgrade to version 3.15.0.6 without delay. Administrative users should also be cautioned against clicking suspicious links while logged into their WordPress dashboard.