CVE-2026-100147: FunnelKit WooCommerce XSS Vulnerability

CVE-2026-100147 Overview

CVE-2026-100147 is a Stored Cross-Site Scripting (XSS) vulnerability in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress. The flaw affects all versions up to and including 3.16.0.5. The plugin fails to sanitize input and escape output for the shipping_first_name parameter. Unauthenticated attackers can inject arbitrary web scripts that execute whenever a user accesses an affected page. The weakness is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative action hijacking, and redirection of store customers.

Affected Products

FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress
All versions up to and including 3.16.0.5
Deployments using the thankyou-pages module (class-wffn-ecomm-tracking.php)

Discovery Timeline

2026-10-10 - CVE-2026-100147 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-100147

Vulnerability Analysis

The vulnerability resides in the FunnelKit Funnel Builder plugin's thank-you page e-commerce tracking logic. The plugin reads the shipping first name supplied during WooCommerce checkout and renders it into page output without applying appropriate sanitization or escaping. Because WooCommerce checkout is reachable by unauthenticated users, any shopper, including an attacker, can submit a crafted shipping_first_name value containing HTML or JavaScript. The payload is then stored and rendered back to any visitor or administrator who loads the affected tracking context, resulting in script execution in their browser session.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping in the thank-you page tracking module. Relevant handling appears in modules/thankyou-pages/includes/class-wffn-ecomm-tracking.php at the lines referenced by the vendor commits. User-controlled checkout fields were echoed into HTML or JavaScript contexts without passing through functions such as esc_html, esc_attr, or wp_kses. This classifies as CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The vulnerability is network reachable and requires no authentication or user interaction to plant the payload. An attacker completes or initiates a WooCommerce checkout and supplies a malicious value in the shipping_first_name field. When a shop administrator, support user, or subsequent visitor loads the thank-you page tracking context, the stored payload executes. Because scope is changed (S:C), script execution can affect browser contexts beyond the vulnerable component, including the WordPress admin interface where privileged actions can be invoked.

Technical details are available in the Wordfence Vulnerability Report and the vendor source in the WordPress Funnel Builder tracking class.

Detection Methods for CVE-2026-100147

Indicators of Compromise

WooCommerce order records containing HTML tags, <script> fragments, or JavaScript event handlers in the shipping_first_name field.
Unexpected outbound requests from administrator browsers after viewing order confirmation or analytics pages.
New or modified WordPress administrator accounts shortly after visits to thank-you pages.
Entries in web server logs showing checkout POST requests with URL-encoded <, >, or javascript: tokens in shipping name parameters.

Detection Strategies

Query the WooCommerce order metadata store for _shipping_first_name values matching regex patterns such as <[a-z/], on[a-z]+=, or javascript:.
Review HTTP access logs for checkout endpoints containing script tag patterns in form fields.
Enable WordPress audit logging to track administrator session anomalies that follow thank-you page views.
Monitor Content Security Policy (CSP) violation reports for inline script executions on WooCommerce pages.

Monitoring Recommendations

Alert on creation of WordPress users with the administrator role outside of change windows.
Monitor plugin and theme file modifications under wp-content/ for unexpected changes following checkout traffic.
Track browser-side errors or CSP reports originating from /checkout/, /order-received/, and FunnelKit thank-you URLs.

How to Mitigate CVE-2026-100147

Immediate Actions Required

Update the FunnelKit – Funnel Builder for WooCommerce Checkout plugin to a version later than 3.16.0.5 that includes the fixes from the referenced changesets.
Audit existing WooCommerce orders for malicious payloads in shipping_first_name and sanitize or purge affected records.
Rotate credentials and invalidate active sessions for any administrator who may have viewed affected thank-you or tracking pages.
Review recent administrator account changes and remove unauthorized users.

Patch Information

The vendor addressed the vulnerability in WordPress plugin repository commits Changeset #3733861 and Changeset #3733886. The fixes apply proper escaping to the affected output locations in class-wffn-ecomm-tracking.php. Site owners should upgrade to the patched release published after version 3.16.0.5.

Workarounds

Deploy a web application firewall rule that blocks checkout submissions containing HTML tags or JavaScript event handlers in name fields.
Enforce a strict Content Security Policy that disallows inline scripts on WooCommerce and admin pages.
Temporarily disable the FunnelKit thank-you page tracking module until the patched plugin version is installed.

bash

# Configuration example
wp plugin update funnel-builder --version=latest
wp eval 'global $wpdb; $r = $wpdb->get_results("SELECT post_id, meta_value FROM {$wpdb->postmeta} WHERE meta_key=\"_shipping_first_name\" AND meta_value REGEXP \"<|javascript:|on[a-z]+=\""); print_r($r);'