Reflected Cross-Site Scripting in FunnelKit WordPress Plugin

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the FunnelKit WordPress plugin before version 3.15.0.6. It occurs when the plugin fails to escape a user-supplied parameter before reflecting it into an HTML response during an AJAX action. The flaw allows unauthenticated attackers to inject malicious scripts into a page, which execute in the browser of logged-in users who open a specially crafted page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if you are running FunnelKit versions prior to 3.15.0.6 with the Divi theme or builder active. Inspect network traffic for POST requests to admin-ajax.php containing the et_wfop_optin_form action and the et_load_builder_modules=1 parameter. Look for the input_size parameter with unexpected script content.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious scripts in the context of a logged-in user's session. If the victim is an administrator, the script runs with elevated privileges. The exploit requires the victim to be logged in and to open a crafted page while logged in.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data theft, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information security). Organizations using affected versions may face increased risk of breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FunnelKit to version 3.15.0.6 or later. If updating is not possible, disable the Divi theme or builder to prevent the vulnerable AJAX action from being registered. Review user roles and remove unnecessary admin privileges to limit potential impact.

Useful 0 Not Useful 0