CVE-2026-47100

🗓️ 19 May 2026 14:00:55Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

Unauthenticated access in Funnel Builder for WooCommerce Checkout below 3.15.0.3 enables writing External Scripts and injecting JavaScript on checkout.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2026-47100	28 May 202613:42	–	githubexploit
ATTACKERKB	CVE-2026-47100	19 May 202614:00	–	attackerkb
Circl	CVE-2026-47100	20 May 202600:00	–	circl
CNNVD	WordPress plugin Funnel Builder for WooCommerce Checkout 安全漏洞	19 May 202600:00	–	cnnvd
Cvelist	CVE-2026-47100 Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX	19 May 202614:00	–	cvelist
EUVD	EUVD-2026-30936	19 May 202614:00	–	euvd
NVD	CVE-2026-47100	19 May 202615:16	–	nvd
Positive Technologies	PT-2026-41938	19 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-47100	5 Jun 202619:21	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2026-47100	14 May 202600:00	–	vulncheck_kev

Vulners

Node

funnelkit funnel_builder_for_woocommerce_checkoutRange0–3.15.0.3

[
  {
    "defaultStatus": "affected",
    "vendor": "FunnelKit",
    "product": "Funnel Builder for WooCommerce Checkout",
    "repo": "https://wordpress.org/plugins/funnel-builder",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThan": "3.15.0.3"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3530797/funnel-builder/tags/3.15.0.3/modules/checkouts/includes/class-wfacp-ajax-controller.php
vulncheck	www.vulncheck.com/advisories/funnel-builder-for-woocommerce-checkout-missing-authorization-via-ajax
sansec	www.sansec.io/research/funnelkit-woocommerce-vulnerability-exploited

Parameter	Position	Path	Description	CWE
wfacp_input_hidden_data	request body	/?wc-ajax=update_order_review	Public checkout AJAX endpoint vulnerable to arbitrary internal method invocation via attacker-controlled data, enabling stored XSS.	CWE-862

19 May 2026 17:57Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

CVSS 48.7

EPSS0.00048

SSVC