Cpe:2.3:a:funnelkit:funnel_builder_for_woocommerce_checkout:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afunnelkitfunnel_builder_for_woocommerce_checkout/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 10 Oct 2026 09:51:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in FunnelKit for WooCommercehttps://feed.craftedsignal.io/briefs/2026-10-funnelkit-xss/Sat, 10 Oct 2026 09:51:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-funnelkit-xss/The FunnelKit Funnel Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the shipping_first_name parameter due to insufficient input sanitization.FunnelKit - Funnel Builder for WooCommerce Checkout, a widely used WordPress plugin, contains a critical Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-100147. This vulnerability exists in all versions up to and including 3.16.0.5. The issue stems from inadequate input sanitization and output escaping on the 'shipping_first_name' parameter. An unauthenticated attacker can supply a malicious payload within this field, which is subsequently stored by the application. When a privileged user, such as an administrator, views the checkout or order details page containing the stored payload, the script executes within their browser session. This can lead to unauthorized actions, session hijacking, or the defacement of the affected WordPress site.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. In an administrative context, this could result in full site compromise, unauthorized administrative actions, or the redirection of site traffic. Given the plugin's role in WooCommerce checkout processes, this vulnerability poses a risk to both site integrity and customer data.

Recommendation

Prioritize the update of the FunnelKit - Funnel Builder for WooCommerce Checkout plugin to a version beyond 3.16.0.5. Detection engineers should inspect web server access logs for anomalous POST requests containing HTML or script tags within checkout-related parameters.

]]>highadvisory