CVE-2026-100147

Deferred Deferred - Pending Action

Stored XSS in FunnelKit Funnel Builder for WooCommerce Checkout

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Wordfence

Description

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100147

EUVD

EUVD-2026-96275

Affected Vendors & Products

Vendor	Product	Version / Range
teamfunnelkit	FunnelKit	– Funnel Builder for WooCommerce Checkout 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress. It exists due to insufficient input sanitization and output escaping in the 'shipping_first_name' parameter. Unauthenticated attackers can inject malicious scripts that execute when users access affected pages.

Detection Guidance

Check WordPress sites using the FunnelKit – Funnel Builder for WooCommerce Checkout plugin versions up to 3.16.0.5 for stored XSS via the 'shipping_first_name' parameter. Inspect web server logs for suspicious script injections in form inputs.

Impact Analysis

An attacker could exploit this to inject malicious scripts into your website. When users visit the compromised page, the scripts could steal cookies, session tokens, or sensitive data. It may also allow attackers to perform actions on behalf of users or deface your site.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR and HIPAA requirements for data protection and confidentiality. If exploited, it may result in data breaches, triggering legal penalties, fines, or reputational damage for organizations handling sensitive information.

Mitigation Strategies

Update the plugin to the latest version beyond 3.16.0.5. If immediate update is not possible, disable the plugin temporarily or add input sanitization for the 'shipping_first_name' parameter via a web application firewall.

Hi! I’m here to help you understand CVE-2026-100147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70