CVE-2026-100147

{
  "etk_id": "ETK-2026-1394",
  "cve_id": "CVE-2026-100147",
  "display_id": "CVE-2026-100147",
  "ghsa_id": "GHSA-x8hv-gh93-vrwq",
  "euvd_id": "EUVD-2026-96275",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in FunnelKit for WooCommerce Checkout",
  "summary": "FunnelKit – Funnel Builder for WooCommerce Checkout for WordPress is affected by stored cross-site scripting in versions through 3.16.0.5. An unauthenticated attacker may cause browser-side script execution when a user visits content containing the injected data.",
  "mitigation": "Update to a vendor release newer than 3.16.0.5 once one is confirmed available. Until then, reduce exposure by restricting public access to checkout and other pages that accept customer shipping details, and review submitted data for unexpected content.",
  "vendor": "teamfunnelkit",
  "product": "FunnelKit – Funnel Builder for WooCommerce Checkout",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.16.0.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "FunnelKit – Funnel Builder for WooCommerce Checkout",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.003,
  "epss_percentile": 0.2107,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 59.38761565,
  "t0_at": "2026-10-10T07:41:43.163000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T18:56:42.988374+00:00",
      "days": 2.4687479788657405,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:41:43.163000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-09T00:00:00+00:00",
      "days": -1,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:41:43.163000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-100147"
    },
    "trigger_signal": {
      "at": "2026-10-09T00:00:00+00:00",
      "days": -1.320638460648148,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:41:43.163000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-100147"
    }
  }
}