CVE-2026-47100

🗓️ 19 May 2026 14:00:55Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 66 Views🌐 WEB

Unauthenticated access in Funnel Builder for WooCommerce Checkout below 3.15.0.3 enables writing External Scripts and injecting JavaScript on checkout.

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for CVE-2026-47100	28 May 202613:42	–	githubexploit
attackerkb	CVE-2026-47100	19 May 202614:00	–	attackerkb
Circl	CVE-2026-47100	20 May 202600:00	–	circl
CNNVD	WordPress plugin Funnel Builder for WooCommerce Checkout 安全漏洞	19 May 202600:00	–	cnnvd
Cvelist	CVE-2026-47100 Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX	19 May 202614:00	–	cvelist
EUVD	EUVD-2026-30936	19 May 202614:00	–	euvd
Kitploit	CVE-2026-47100-Analysis-Lab	8 Oct 202611:58	–	kitploit
NVD	CVE-2026-47100	19 May 202615:16	–	nvd
Positive Technologies	PT-2026-41938	19 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-47100: Missing Authorization	19 May 202600:00	–	rapid7

Vulners

CNA

Node

funnelkit funnel_builder_for_woocommerce_checkoutRange0–3.15.0.3

[
  {
    "defaultStatus": "affected",
    "vendor": "FunnelKit",
    "product": "Funnel Builder for WooCommerce Checkout",
    "repo": "https://wordpress.org/plugins/funnel-builder",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThan": "3.15.0.3"
      }
    ]
  }
]

Source	Link
sansec	www.sansec.io/research/funnelkit-woocommerce-vulnerability-exploited
plugins	www.plugins.trac.wordpress.org/changeset/3530797/funnel-builder/tags/3.15.0.3/modules/checkouts/includes/class-wfacp-ajax-controller.php
vulncheck	www.vulncheck.com/advisories/funnel-builder-for-woocommerce-checkout-missing-authorization-via-ajax

Parameter	Position	Path	Description	CWE
post_data	request body	/?wc-ajax=update_order_review	Unauthenticated checkout AJAX can invoke internal method update_global_settings_fields via wfacp_input_hidden_data and store JavaScript in _wfacp_global_settings/wfacp_global_external_script, enabling Stored XSS on checkout pages.	CWE-862

28 Jul 2026 01:48Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

CVSS 48.7

EPSS0.0049

SSVC