CVE-2026-47100

Name of the Vulnerable Software and Affected Versions Funnel Builder for WooCommerce Checkout versions prior to 3.15.0.3

Description A missing authorization issue in the public checkout endpoint allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. This enables the injection of malicious JavaScript through the External Scripts setting, which then executes in the browsers of all visitors to the checkout page.

Recommendations Update to version 3.15.0.3 or later.