WordPress plugin
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High8
- Medium12
- Low0
All FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter ≤3.16.0.6Update to 3.17.0 | CVE-2026-107746 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing) ≤3.16.0.5Update to 3.16.0.6 | CVE-2026-100147 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.15.0.8Update to 3.15.0.9 | CVE-2026-57816 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.15.0.5Update to 3.15.0.6 | CVE-2026-12978 | |
| Medium6.5 | Authenticated (Admin+) Arbitrary File Deletion ≤3.15.0.5Update to 3.15.0.6 | CVE-2026-12979 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection ≤3.15.0.5Update to 3.15.0.6 | CVE-2026-56052 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.15.0.2Update to 3.15.0.3 | CVE-2026-48966 | |
| Medium5.3 | Missing Authorization ≤3.15.0.2Update to 3.15.0.3 | CVE-2026-47100 | |
| High7.5 | Unauthenticated SQL Injection ≤3.15.0.1Update to 3.15.0.2 | CVE-2026-42381 | |
| High7.5 | Unauthenticated SQL Injection ≤3.13.1.5Update to 3.13.1.6 | CVE-2025-14169 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.13.1.2Update to 3.13.1.3 | CVE-2025-66067 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode ≤3.13.1.2Update to 3.13.1.3 | CVE-2025-12878 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.12.0Update to 3.12.0.1 | CVE-2025-10567 | |
| High8.1 | Unauthenticated Local File Inclusion ≤3.11.1Update to 3.12.0 | CVE-2025-54750 | |
| High8.8 | Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library ≤3.6.3Update to 3.6.4 | CVE-2025-7654 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection ≤3.10.2Update to 3.11.0 | CVE-2025-49034 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection ≤3.10.1Update to 3.10.2 | CVE-2025-2203 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤3.9.0Update to 3.9.1 | CVE-2025-26979 | |
| Medium4.3 | Missing Authorization to Authenticated (Contributor+) Settings Update ≤3.4.6Update to 3.4.7 | CVE-2024-6836 | |
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload ≤3.3.1Update to 3.4.0 | CVE-2024-5192 | |
| Medium6.6 | Authenticated(Administrator+) SQL Injection <2.14.4Update to 2.14.4 | CVE-2023-50856 |
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
≤3.16.0.6Update to 3.17.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
≤3.16.0.5Update to 3.16.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.0.8Update to 3.15.0.9
- Medium6.1Reflected Cross-Site Scripting
≤3.15.0.5Update to 3.15.0.6
- Medium6.5Authenticated (Admin+) Arbitrary File Deletion
≤3.15.0.5Update to 3.15.0.6
- Medium4.9Authenticated (Administrator+) SQL Injection
≤3.15.0.5Update to 3.15.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.0.2Update to 3.15.0.3
- Medium5.3Missing Authorization
≤3.15.0.2Update to 3.15.0.3
- High7.5Unauthenticated SQL Injection
≤3.15.0.1Update to 3.15.0.2
- High7.5Unauthenticated SQL Injection
≤3.13.1.5Update to 3.13.1.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.13.1.2Update to 3.13.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode
≤3.13.1.2Update to 3.13.1.3
- Medium6.1Reflected Cross-Site Scripting
≤3.12.0Update to 3.12.0.1
- High8.1Unauthenticated Local File Inclusion
≤3.11.1Update to 3.12.0
- High8.8Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library
≤3.6.3Update to 3.6.4
- Medium4.9Authenticated (Administrator+) SQL Injection
≤3.10.2Update to 3.11.0
- Medium4.9Authenticated (Administrator+) SQL Injection
≤3.10.1Update to 3.10.2
- Critical9.8Unauthenticated Local File Inclusion
≤3.9.0Update to 3.9.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Settings Update
≤3.4.6Update to 3.4.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
≤3.3.1Update to 3.4.0
- Medium6.6Authenticated(Administrator+) SQL Injection
<2.14.4Update to 2.14.4
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout: common questions
Does FunnelKit – Funnel Builder Plugin for WooCommerce Checkout have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in FunnelKit – Funnel Builder Plugin for WooCommerce Checkout: 1 critical, 8 high, 12 medium. None are known to affect version null.
How do I check which version of FunnelKit – Funnel Builder Plugin for WooCommerce Checkout I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerability?
CVE-2026-107746, published Oct 15, 2026: FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter. Severity: High (CVSS 7.5).
Is any FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerability listed in CISA KEV?
No. None of the known FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerabilities is currently listed in the CISA KEV catalog.