CVE-2026-57374 is an unauthenticated cross-site scripting (XSS) vulnerability classified under CWE-79 in Funnel Kit Funnel Builder PRO by Wisetr INC. The issue affects versions up to 3.15.0.7 and arises from improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. No official fix or patch has been published yet.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of users visiting affected web pages, potentially resulting in information disclosure, modification of web content, or disruption of service. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. Since the vulnerability is unauthenticated, attackers do not need credentials to exploit it. However, user interaction is required for the attack to succeed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding if possible. Monitor vendor communications for updates and apply patches promptly once released.