CVE-2026-100147: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in teamfunnelkit FunnelKit – Funnel Builder for WooCommerce Checkout

CVE-2026-100147 is a Stored Cross-Site Scripting vulnerability in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress. The vulnerability arises from insufficient sanitization and escaping of the 'shipping_first_name' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. This affects all versions from 0 up to 3.16.0.5 inclusive. The CVSS 3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker can inject malicious scripts via the 'shipping_first_name' parameter that will be stored and executed in the context of users visiting the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability does not impact system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the affected parameter or plugin functionality. Monitoring for suspicious activity related to this parameter is advised. No official fix or patch links are currently provided.