Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: teamfunnelkit Clear all filters
TI-2026-86543 CVE-2026-109991 · GHSA-jr5x-vmcq-9485

FunnelKit Payment Gateway for Stripe IDOR exposes order billing data

Priority LOW 36

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/o…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS — Published 2026-11-07 No fix listed CWE-639
TI-2026-83500 CVE-2026-119163 · GHSA-3h7v-9626-9c6v

Unauthenticated SQL injection in FunnelKit Automations plugin

Priority LOW 39

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and inclu…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00304 Published 2026-10-31 No fix listed CWE-89
TI-2026-75165 CVE-2026-107746 · GHSA-fjvp-gr2j-2xrc

Missing authorization in FunnelKit exposes WooCommerce order billing data

Priority LOW 39

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a us…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00318 Published 2026-10-16 No fix listed CWE-862
TI-2026-70220 CVE-2026-100147 · GHSA-x8hv-gh93-vrwq

FunnelKit Unauthenticated Stored Cross-Site Scripting via Order Fields

Priority LOW 31

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insu…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00297 Published 2026-10-10 No fix listed CWE-79