The FunnelKit WordPress plugin prior to version 3.15.0.6 contains a reflected XSS vulnerability (CWE-79) due to improper escaping of user input in a page-builder AJAX action. This action is conditionally registered only when the Divi builder is active. An unauthenticated attacker can exploit this by crafting a malicious page that, when visited by a logged-in user, executes arbitrary script code in the context of that user's browser session.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of logged-in users who access a crafted page, potentially leading to session hijacking, privilege escalation, or other malicious actions within the user's session. The vulnerability requires the Divi builder to be active and affects only logged-in users, limiting the attack surface to authenticated users.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling the Divi builder integration with FunnelKit or restrict access to the affected AJAX actions. Monitor vendor communications for updates and apply official patches promptly once available.