WordPress plugin
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High8
- Medium12
- Low0
All FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter ≤3.16.0.6Update to 3.17.0 | CVE-2026-107746 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing) ≤3.16.0.5Update to 3.16.0.6 | CVE-2026-100147 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.15.0.8Update to 3.15.0.9 | CVE-2026-57816 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.15.0.2Update to 3.15.0.3 | CVE-2026-48966 | |
| High7.5 | Unauthenticated SQL Injection ≤3.15.0.1Update to 3.15.0.2 | CVE-2026-42381 | |
| High7.5 | Unauthenticated SQL Injection ≤3.13.1.5Update to 3.13.1.6 | CVE-2025-14169 | |
| High8.1 | Unauthenticated Local File Inclusion ≤3.11.1Update to 3.12.0 | CVE-2025-54750 | |
| High8.8 | Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library ≤3.6.3Update to 3.6.4 | CVE-2025-7654 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤3.9.0Update to 3.9.1 | CVE-2025-26979 |
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
≤3.16.0.6Update to 3.17.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
≤3.16.0.5Update to 3.16.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.0.8Update to 3.15.0.9
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.0.2Update to 3.15.0.3
- High7.5Unauthenticated SQL Injection
≤3.15.0.1Update to 3.15.0.2
- High7.5Unauthenticated SQL Injection
≤3.13.1.5Update to 3.13.1.6
- High8.1Unauthenticated Local File Inclusion
≤3.11.1Update to 3.12.0
- High8.8Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library
≤3.6.3Update to 3.6.4
- Critical9.8Unauthenticated Local File Inclusion
≤3.9.0Update to 3.9.1
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout: common questions
Does FunnelKit – Funnel Builder Plugin for WooCommerce Checkout have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in FunnelKit – Funnel Builder Plugin for WooCommerce Checkout: 1 critical, 8 high, 12 medium. None are known to affect version null.
How do I check which version of FunnelKit – Funnel Builder Plugin for WooCommerce Checkout I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerability?
CVE-2026-107746, published Oct 15, 2026: FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter. Severity: High (CVSS 7.5).
Is any FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerability listed in CISA KEV?
No. None of the known FunnelKit – Funnel Builder Plugin for WooCommerce Checkout vulnerabilities is currently listed in the CISA KEV catalog.