[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0cy1kzygcO4zZ-dhKLgaaU-tbbe4JDKa-6UgPPIeH3w":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-57816","funnelkit-funnel-builder-for-woocommerce-checkout-unauthenticated-stored-cross-site-scripting-2","FunnelKit – Funnel Builder for WooCommerce Checkout \u003C= 3.15.0.8 - Unauthenticated Stored Cross-Site Scripting","The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.15.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","funnel-builder",null,"\u003C=3.15.0.8","3.15.0.9","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 00:00:00","2026-07-14 19:33:14",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc31de71e-254a-4ae1-a4f1-0922c26d4154?source=api-prod",5,[22,23,24,25,26,27,28],"admin\u002Fclass-wffn-admin.php","admin\u002Frest-api-helpers\u002Fclass-wffn-rest-api-helpers.php","admin\u002Frest-api\u002Fclass-wffn-funnel-contacts.php","admin\u002Frest-api\u002Fclass-wffn-rest-api-dashboard-endpoint.php","admin\u002Frest-api\u002Fclass-wffn-rest-funnel-modules.php","admin\u002Frest-api\u002Fclass-wffn-rest-funnels.php","admin\u002Fviews\u002Fcontact\u002Fdist\u002F0.9951c3b93dace3439051.js","researched",false,3,"This vulnerability research plan focuses on **CVE-2026-57816**, a stored Cross-Site Scripting (XSS) vulnerability in **FunnelKit – Funnel Builder for WooCommerce Checkout**. The vulnerability exists because the plugin's REST API endpoints do not properly enforce permission checks for write operations and fail to sanitize\u002Fescape funnel data that is subsequently rendered in the admin dashboard using React's `dangerouslySetInnerHTML`.\n\n---\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Unauthenticated Stored Cross-Site Scripting (XSS)\n*   **Location:** `admin\u002Frest-api\u002Fclass-wffn-rest-funnels.php` (Injection) and `admin\u002Fviews\u002Fcontact\u002Fdist\u002F0.9951c3b93dace3439051.js` (Execution).\n*   **Cause:** The `permission_callback` for the FunnelKit REST API (`get_write_api_permission_check`) is improperly implemented in version 3.15.0.8, allowing unauthenticated users to create or update funnels. Furthermore, properties like `title` or `icon` in the funnel\u002Fstep data are not sanitized on input and are rendered as raw HTML in the React-based admin UI.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `POST \u002Fwp-json\u002Ffunnelkit-app\u002Ffunnels` (Create Funnel) or `POST \u002Fwp-json\u002Ffunnelkit-app\u002Ffun","The FunnelKit Funnel Builder plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS). This occurs because the plugin's REST API endpoints fail to properly verify permissions for funnel creation\u002Fmodification and do not sanitize fields like 'icon' or 'title' before rendering them in the React-based admin dashboard using dangerouslySetInnerHTML.","\u002F\u002F admin\u002Fviews\u002Fcontact\u002Fdist\u002F0.9951c3b93dace3439051.js\n\u002F\u002F React component rendering funnel options without escaping\nt.icon&&Object(r.createElement)(\"span\",{dangerouslySetInnerHTML:{__html:t.icon}})\n\n---\n\n\u002F\u002F admin\u002Frest-api\u002Fclass-wffn-rest-funnels.php line 78\n\u002F\u002F Registration of the CREATABLE endpoint using a flawed permission check\narray(\n    'methods'             => WP_REST_Server::CREATABLE,\n    'callback'            => array( $this, 'create_funnel' ),\n    'permission_callback' => array( $this, 'get_write_api_permission_check' ),\n    'args'                => array_merge( $this->get_endpoint_args_for_item_schema( WP_REST_Server::CREATABLE ), $this->get_create_funnels_collection() ),\n),","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.8\u002Fadmin\u002Fclass-wffn-admin.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.9\u002Fadmin\u002Fclass-wffn-admin.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.8\u002Fadmin\u002Fclass-wffn-admin.php\t2026-06-24 12:12:50.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.9\u002Fadmin\u002Fclass-wffn-admin.php\t2026-07-01 13:06:10.000000000 +0000\n@@ -822,7 +822,7 @@\n \t\t\t\twp_enqueue_style( 'wffn-flex-admin', $this->get_admin_url() . '\u002Fassets\u002Fcss\u002Fadmin.css', array(), WFFN_VERSION_DEV );\n \n \t\t\t\tif ( WFFN_Core()->admin->is_wffn_flex_page() ) {\n-\t\t\t\t\t$this->load_react_app( 'main-20260624114421' ); \u002F\u002Fphpcs:ignore WordPressVIPMinimum.Security.Mustache.OutputNotation\n+\t\t\t\t\t$this->load_react_app( 'main-20260701122529' ); \u002F\u002Fphpcs:ignore WordPressVIPMinimum.Security.Mustache.OutputNotation\n \t\t\t\t\tif ( isset( $_GET['page'] ) && $_GET['page'] === 'bwf' && method_exists( 'BWF_Admin_General_Settings', 'get_localized_bwf_data' ) ) { \u002F\u002F phpcs:ignore WordPress.Security.NonceVerification.Recommended\n \t\t\t\t\t\twp_localize_script( 'wffn-contact-admin', 'bwfAdminGen', BWF_Admin_General_Settings::get_instance()->get_localized_bwf_data() );\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.8\u002Fadmin\u002Frest-api\u002Fclass-wffn-rest-funnel-modules.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.9\u002Fadmin\u002Frest-api\u002Fclass-wffn-rest-funnel-modules.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.8\u002Fadmin\u002Frest-api\u002Fclass-wffn-rest-funnel-modules.php\t2026-06-23 14:17:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffunnel-builder\u002F3.15.0.9\u002Fadmin\u002Frest-api\u002Fclass-wffn-rest-funnel-modules.php\t2026-07-01 13:06:10.000000000 +0000\n@@ -1178,7 +1178,7 @@\n \t\t\t\t$options = $this->sanitize_custom( $post_data['settings'], true );\n \t\t\t}\n \n-\t\t\t$options['custom_css'] = isset( $options['custom_css'] ) ? htmlentities( $options['custom_css'] ) : '';\n+\t\t\t$options['custom_css'] = isset( $options['custom_css'] ) ? htmlentities( WFFN_Common::sanitize_global_css( $options['custom_css'] ) ) : '';\n \t\t\t$options['custom_js']  = isset( $options['custom_js'] ) ? htmlentities( $options['custom_js'] ) : '';\n \t\t\tif ( ! empty( $options['select_redirect_page'] ) ) {","An unauthenticated attacker sends a crafted POST request to the `\u002Fwp-json\u002Ffunnelkit-app\u002Ffunnels` REST API endpoint. Because version 3.15.0.8 has a broken permission check in `get_write_api_permission_check`, the request is accepted even without valid administrator credentials. The payload includes a malicious script inside the `icon` or `title` fields of the funnel object. When an administrator later logs into the WordPress backend and navigates to the FunnelKit dashboard, the React frontend renders the malicious script via `dangerouslySetInnerHTML`, leading to script execution in the admin's browser session.","gemini-3-flash-preview","2026-07-15 10:08:07","2026-07-15 10:09:35",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","3.15.0.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffunnel-builder\u002Ftags\u002F3.15.0.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffunnel-builder.3.15.0.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffunnel-builder\u002Ftags\u002F3.15.0.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffunnel-builder.3.15.0.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffunnel-builder\u002Ftags"]