This vulnerability (CVE-2026-48966) is an unauthenticated Cross-Site Scripting (XSS) issue in Funnel Builder by FunnelKit affecting versions up to 3.15.0.2. It arises from improper neutralization of input during web page generation (CWE-79). The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. No patch or official remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to inject malicious scripts into web pages generated by the vulnerable Funnel Builder plugin. This can lead to partial compromise of user confidentiality, integrity, and availability, such as session hijacking, defacement, or other malicious actions executed in the context of the victim's browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling or restricting access to the vulnerable plugin or implementing web application firewall (WAF) rules to detect and block XSS payloads targeting this component.