CVE-2026-100147

Name of the Vulnerable Software and Affected Versions FunnelKit – Funnel Builder for WooCommerce Checkout versions prior to 3.16.0.6

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the shipping first name parameter, which execute when a user accesses the affected page.

Recommendations Update FunnelKit – Funnel Builder for WooCommerce Checkout to version 3.16.0.6 or later. Avoid using the shipping first name parameter until the update is applied.