CVE‑2026‑57373 exposes a Customer Cross‑Site Scripting vulnerability in the Wisetr INC. Funnel Kit Funnel Builder PRO WordPress plugin for versions up to and including 3.15.0.4. The flaw is a classic input validation weakness classified as CWE‑79, allowing an attacker to inject arbitrary JavaScript into the plugin’s output. If executed, the malicious script runs in the context of any visitor’s browser, potentially enabling session hijacking, data theft, or defacement of the site’s contents.

The vulnerability affects WordPress sites that have Wisetr Inc.’s Funnel Kit Funnel Builder PRO plugin installed at a version no higher than 3.15.0.4. All WordPress installations containing this plugin within the specified version range are susceptible to the flaw.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests that widespread exploitation has not been observed. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit the weakness by submitting malicious input through the plugin’s form fields or configuration interface; the unsanitized payload is then rendered on the front‑end, causing arbitrary JavaScript to execute for any site visitor. No elevated privileges or network access are required, however a user who visits a vulnerable page can be affected.