FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.8 - Unauthenticated Stored Cross-Site Scripting
Description
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.15.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=3.15.0.8What Changed in the Fix
Changes introduced in v3.15.0.9
Source Code
WordPress.org SVNThis vulnerability research plan focuses on **CVE-2026-57816**, a stored Cross-Site Scripting (XSS) vulnerability in **FunnelKit – Funnel Builder for WooCommerce Checkout**. The vulnerability exists because the plugin's REST API endpoints do not properly enforce permission checks for write operation…
Show full research plan
This vulnerability research plan focuses on CVE-2026-57816, a stored Cross-Site Scripting (XSS) vulnerability in FunnelKit – Funnel Builder for WooCommerce Checkout. The vulnerability exists because the plugin's REST API endpoints do not properly enforce permission checks for write operations and fail to sanitize/escape funnel data that is subsequently rendered in the admin dashboard using React's dangerouslySetInnerHTML.
1. Vulnerability Summary
- Vulnerability: Unauthenticated Stored Cross-Site Scripting (XSS)
- Location:
admin/rest-api/class-wffn-rest-funnels.php(Injection) andadmin/views/contact/dist/0.9951c3b93dace3439051.js(Execution). - Cause: The
permission_callbackfor the FunnelKit REST API (get_write_api_permission_check) is improperly implemented in version 3.15.0.8, allowing unauthenticated users to create or update funnels. Furthermore, properties liketitleoriconin the funnel/step data are not sanitized on input and are rendered as raw HTML in the React-based admin UI.
2. Attack Vector Analysis
- Endpoint:
POST /wp-json/funnelkit-app/funnels(Create Funnel) or `POST /wp-json/funnelkit-app/fun
Summary
The FunnelKit Funnel Builder plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS). This occurs because the plugin's REST API endpoints fail to properly verify permissions for funnel creation/modification and do not sanitize fields like 'icon' or 'title' before rendering them in the React-based admin dashboard using dangerouslySetInnerHTML.
Vulnerable Code
// admin/views/contact/dist/0.9951c3b93dace3439051.js // React component rendering funnel options without escaping t.icon&&Object(r.createElement)("span",{dangerouslySetInnerHTML:{__html:t.icon}}) --- // admin/rest-api/class-wffn-rest-funnels.php line 78 // Registration of the CREATABLE endpoint using a flawed permission check array( 'methods' => WP_REST_Server::CREATABLE, 'callback' => array( $this, 'create_funnel' ), 'permission_callback' => array( $this, 'get_write_api_permission_check' ), 'args' => array_merge( $this->get_endpoint_args_for_item_schema( WP_REST_Server::CREATABLE ), $this->get_create_funnels_collection() ), ),
Security Fix
@@ -822,7 +822,7 @@ wp_enqueue_style( 'wffn-flex-admin', $this->get_admin_url() . '/assets/css/admin.css', array(), WFFN_VERSION_DEV ); if ( WFFN_Core()->admin->is_wffn_flex_page() ) { - $this->load_react_app( 'main-20260624114421' ); //phpcs:ignore WordPressVIPMinimum.Security.Mustache.OutputNotation + $this->load_react_app( 'main-20260701122529' ); //phpcs:ignore WordPressVIPMinimum.Security.Mustache.OutputNotation if ( isset( $_GET['page'] ) && $_GET['page'] === 'bwf' && method_exists( 'BWF_Admin_General_Settings', 'get_localized_bwf_data' ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended wp_localize_script( 'wffn-contact-admin', 'bwfAdminGen', BWF_Admin_General_Settings::get_instance()->get_localized_bwf_data() ); @@ -1178,7 +1178,7 @@ $options = $this->sanitize_custom( $post_data['settings'], true ); } - $options['custom_css'] = isset( $options['custom_css'] ) ? htmlentities( $options['custom_css'] ) : ''; + $options['custom_css'] = isset( $options['custom_css'] ) ? htmlentities( WFFN_Common::sanitize_global_css( $options['custom_css'] ) ) : ''; $options['custom_js'] = isset( $options['custom_js'] ) ? htmlentities( $options['custom_js'] ) : ''; if ( ! empty( $options['select_redirect_page'] ) ) {
Exploit Outline
An unauthenticated attacker sends a crafted POST request to the `/wp-json/funnelkit-app/funnels` REST API endpoint. Because version 3.15.0.8 has a broken permission check in `get_write_api_permission_check`, the request is accepted even without valid administrator credentials. The payload includes a malicious script inside the `icon` or `title` fields of the funnel object. When an administrator later logs into the WordPress backend and navigates to the FunnelKit dashboard, the React frontend renders the malicious script via `dangerouslySetInnerHTML`, leading to script execution in the admin's browser session.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.