FunnelKit up to 3.16.0.5 – Exploited Unauthenticated Stored XSS (CVE-2026-100147)
FunnelKit versions through 3.16.0.5 contain an unauthenticated stored cross-site scripting vulnerability in WooCommerce order fields. CVE-2026-100147 has a CVSS score of 7.2 in the Wordfence record, and Patchstack marks the issue as known to be exploited. Sites should update to 3.16.0.6 or later and review recent checkout data.
Vulnerability summary
- Product: FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
- Plugin slug:
funnel-builder - Affected versions: 3.16.0.5 and earlier
- Fixed version: 3.16.0.6
- CVE: CVE-2026-100147
- Severity: High, CVSS 7.2 in Wordfence
- Authentication required: No
- User interaction: A privileged user must view affected stored order data for the script to execute
- Exploitation status: Marked “Known to be exploited” by Patchstack
How the flaw works
Wordfence attributes the flaw to insufficient input sanitization and output escaping of the WooCommerce shipping_first_name order field. An unauthenticated visitor can submit crafted checkout data that is stored with an order. The injected script executes later when a privileged user opens a vulnerable page that renders the stored value.
This attack does not grant privileges at the moment the checkout request is sent. It relies on stored data being displayed to an administrator or another privileged user. Once executed in that user’s browser, malicious JavaScript may act with the victim’s authenticated WordPress session, exposing account or site-management actions available in that context.
Patchstack’s “known to be exploited” label is vendor intelligence and should not be confused with inclusion in the U.S. CISA KEV catalog. WPDeeply did not find authoritative confirmation that CVE-2026-100147 is currently listed by CISA.
Immediate remediation
- Update FunnelKit to version 3.16.0.6 or later. The current WordPress.org release is newer than the minimum fixed version.
- Until patching is complete, restrict access to WooCommerce order administration and avoid opening suspicious new orders in an administrator session.
- Review recent orders, including failed and pending orders, for unexpected markup or encoded script-like content in shipping and billing name fields.
- Invalidate sessions and rotate credentials for privileged users who viewed suspicious order data.
- Review recently created users, installed plugins, modified files, webhooks, payment settings, and scheduled tasks for follow-on activity.
The FunnelKit changelog says version 3.16.0.6 hardened output containing inline scripts on the order-received page.
Verification with WP-CLI
wp plugin get funnel-builder --fields=name,status,version,update,update_version
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp core verify-checksums
wp plugin verify-checksums funnel-builderConfirm that FunnelKit is at least 3.16.0.6. Then inspect recent WooCommerce orders through a clean, fully patched administrative session. Do not reproduce or render suspicious field content in a browser outside an isolated investigation environment.
Indicators to review
- Shipping or billing first-name values containing HTML tags, event-handler text, encoded markup, or unexpected long strings.
- Checkout requests followed by privileged admin actions that the administrator does not recognize.
- New administrators, plugin installations, webhook changes, checkout-setting changes, or unfamiliar redirects after a suspicious order was viewed.
- Repeated unauthenticated checkout attempts using unusual shipping-name values.
Sources
