Funnelkit Funnel Builder For Woocommerce Checkout
Monthly
Unauthenticated stored cross-site scripting (XSS) in FunnelKit - Funnel Builder for WooCommerce Checkout versions up to and including 3.16.0.5 allows attackers to inject malicious scripts via the 'shipping_first_name' checkout parameter, which are then executed when a user views the affected thank-you page. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's e-commerce tracking code. No public exploit code or active exploitation has been identified at this time, and the risk is considered notable but not top-priority given the need for a victim to view the injected page. This affects any WooCommerce store using the vulnerable plugin with a publicly reachable checkout flow.
Unauthenticated stored cross-site scripting (XSS) in FunnelKit - Funnel Builder for WooCommerce Checkout versions up to and including 3.16.0.5 allows attackers to inject malicious scripts via the 'shipping_first_name' checkout parameter, which are then executed when a user views the affected thank-you page. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's e-commerce tracking code. No public exploit code or active exploitation has been identified at this time, and the risk is considered notable but not top-priority given the need for a victim to view the injected page. This affects any WooCommerce store using the vulnerable plugin with a publicly reachable checkout flow.