teamfunnelkit
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| FunnelKit – Funnel Builder for WooCommerce Checkout | 1 | – | Oct 10, 2026 |
| FunnelKit – Funnel Builder Plugin for WooCommerce Checkout | 1 | – | Oct 16, 2026 |
| FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce | 1 | – | Oct 31, 2026 |
| FunnelKit Payment Gateway for Stripe WooCommerce | 1 | – | Nov 7, 2026 |
Exploited and recent CVEs
- CVE-2026-109991 FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter –
- CVE-2026-119163 FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter 0.3%
- CVE-2026-107746 FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter 0.3%
- CVE-2026-100147 FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing) 0.3%