FunnelKit EUVD-2026-96275

Requires a live WordPress site running FunnelKit - Funnel Builder for WooCommerce Checkout (version ≤ 3.16.0.5) with the WooCommerce checkout flow reachable by the public - the default deployment mode for stores using FunnelKit funnels. The attacker needs no authentication and simply supplies a malicious value in the 'shipping_first_name' checkout parameter, which the plugin's thank-you page / e-commerce tracking code (class-wffn-ecomm-tracking.php) later outputs without adequate escaping. The limiting factor is that execution only occurs when a user - in practice a store administrator or operator viewing the injected order/thank-you page - subsequently loads the affected page; it does not fire at injection time. No non-default configuration is required beyond having the vulnerable plugin active on a WooCommerce store.

This is a genuinely notable but not top-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) indicates network-based, low-complexity, unauthenticated exploitation with a scope change - consistent with a stored XSS where an attacker-supplied checkout field persists and later executes in another user's (likely an admin or shop operator) browser context. The unauthenticated vector (PR:N) is the main risk amplifier: anyone who can reach the WooCommerce checkout can plant the payload. However, several signals temper urgency: no EPSS score was provided, KEV=NO (not in CISA KEV), and no public POC is indicated, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Impact is limited to C:L/I:L with A:N - this is script execution in a victim's session, not direct RCE or data destruction, though a successful payload against an administrator could escalate to session/account takeover and thereby broader compromise. One discrepancy to verify: the vector lists UI:N, yet a stored XSS inherently requires a user to subsequently access the injected page for execution - Wordfence rates these as UI:N by convention, but defenders should treat 'a user must view the injected page' as a de facto trigger condition. Overall: a real, patch-worthy vulnerability driven primarily by the unauthenticated injection vector, but currently lower real-world priority than KEV-listed or weaponized flaws given no exploitation evidence.

An unauthenticated attacker proceeds through the WooCommerce checkout on a store running FunnelKit Funnel Builder and submits a JavaScript payload in the 'shipping_first_name' field. The plugin stores the value and later renders it without sufficient sanitization/escaping (e.g., on thank-you page / e-commerce tracking output), so the script executes in the browser of any user - typically a shop administrator reviewing the order - potentially hijacking their authenticated session. No public exploit code is identified at time of analysis, but the technique is trivial and well-understood.