CVE-2026-47100 is a missing authorization vulnerability in Funnel Builder for WooCommerce Checkout before version 3.15.0.3. The vulnerability exists in the public checkout endpoint, which does not properly restrict access, allowing unauthenticated attackers to call internal methods. This enables attackers to write arbitrary data to the External Scripts global setting of the plugin. As a result, malicious JavaScript can be injected and executed in the browsers of users visiting the checkout page, potentially leading to cross-site scripting attacks or other client-side compromises. The CVSS 4.0 base score is 8.7, indicating a high severity vulnerability with network attack vector, no privileges required, no user interaction needed, and high impact on integrity.

An attacker can inject malicious JavaScript into the External Scripts setting of the plugin, which will execute in the browsers of all visitors to the checkout page. This can lead to client-side code execution, potentially compromising user data, session tokens, or performing actions on behalf of users. The vulnerability requires no authentication and no user interaction, increasing the risk of widespread exploitation if leveraged.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided and the remediation level is unknown, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the checkout endpoint or disabling the plugin if feasible to prevent exploitation.