FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout has 21 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 21 are fixed as of October 2026. Their average CVSS score is 6.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 8 high. 2026 was the busiest year with 9 disclosures.
The most common weakness is Cross-Site Scripting, behind 8 of the records (38%). Other recurring categories include SQL Injection, Missing Authorization.
Every one of the 21 issues recorded for FunnelKit – Funnel Builder Plugin for WooCommerce Checkout has a vendor fix available, so running the current release closes all known holes.
16 independent researchers contributed these findings, most of them (2) reported by daroo. FunnelKit – Funnel Builder Plugin for WooCommerce Checkout is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-26979Funnel Builder by FunnelKit <= 3.9.0 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records

FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
Author
FunnelKit
WooCommerce Checkout Plugin & WordPress Funnel Builder Tired of paying high monthly fees for rigid checkout plugins and funnel builders? You don’t need to anymore. Meet FunnelKit (formerly WooFunnels): the most intuitive and affordable Funnel Builder for WordPress. It makes the process of creating conversion-optimized WooCommerce checkouts, beautiful opt-in pages, landing pages, one-click upsells and even thank you pages a breeze. FunnelKit Funnel Builder helps store owners by enhancing WooCommerce checkout conversions with pre-designed templates for every use case. You can create unlimited sales funnels to attract visitors and guide them toward becoming loyal customers. FunnelKit provides you with pre-built templates that are 100% mobile-responsive and look great on all devices. You can find templates for designing custom WooCommerce checkouts, sales pages, lead generation pages, order bumps, one-click upsells, and thank you pages. And you can even customize these templates with any of the popular page builders. Use FunnelKit’s Funnel Builder to create: Optimized WooCommerce checkout pages, including one-page checkouts Multi-step checkouts (Pro) Beautiful sales/landing pages Highly targeted order bumps (Pro) Rule-based one-click upsell offers (Pro) Custom thank you or order confirmation pages Lead generation and opt-in confirmation pages Get ready to attract more paying customers to your business! The WooCommerce Checkout Plugin Built for Conversions FunnelKit Funnel Builder is also a complete WooCommerce checkout plugin. The default WooCommerce checkout is a single rigid form, on a page you can’t design, with fields you can’t reorder and no way to offer anything extra before the customer pays. Every unnecessary field is another reason to abandon. Customize your WooCommerce checkout page Import a conversion-optimized checkout template and edit the whole page visually in Elementor, Divi, Bricks, Oxygen or Gutenberg. Every template includes trust seals, product guarantees and customer reviews. No code, and no editing your theme’s template files. Edit your checkout fields by dragging them Reorder and rearrange the existing checkout fields and sections, and reposition fields like email and phone that WooCommerce places poorly by default, so you capture them earlier in the form. Remove the fields you don’t need. Fewer fields means fewer abandoned checkouts. Faster checkout for every shopper Express pay buttons let mobile shoppers pay with Apple Pay or Google Pay without typing card details. Inline validation catches errors as the customer types, an enhanced international phone field reduces mistakes, and smart login speeds up returning customers. Live cart capturing saves the shopper’s email the moment it’s typed, so abandoned checkouts can be followed up automatically. Works with every native payment gateway Stripe, PayPal, WooPayments, Authorize.net, Braintree, Square and Mollie all work on the FunnelKit checkout, so it fits the payment setup you already have. Replace your checkout storewide and raise order value With FunnelKit, you can override the default WooCommerce checkout across your entire store. Funnel Builder Pro lets you build one-page or multi-step layouts, add custom and conditional fields, and place rule-based order bumps on the checkout page with one-click upsells straight after it. WHY DO YOU NEED A SALES FUNNEL? A sales funnel takes users from downloading a lead magnet to buying your product or service. Not only that, it boosts your average order value through order bumps and one-click upsells. Here are some major benefits of a sales funnel: Fewer Distractions: Users go from one step to the next without any exit points along the way. Higher Return on Ad Spend: Creating optimized user journeys allows you to maximize returns on ad spends. Greater Order Value: Show customers relevant pre- and post-purchase offers they can accept with one click. Higher Conversion Rates: With marketing automation added to your sales funnel, you can bring abandoned users back to complete their purchase. Let’s explore the essential features of FunnelKit Funnel Builder. FUNNEL BUILDER LITE FEATURES Customized WooCommerce Checkout Page Storewide Design beautiful, conversion-optimized WooCommerce checkout pages for your store. Every FunnelKit checkout template includes trust seals, product guarantees, customer reviews and more. Customize your WooCommerce checkout page for more conversions with these proven techniques. Truly Flexible WooCommerce Checkout Field Editor Take control of your WooCommerce checkout form. Edit, reorder and rearrange the existing checkout fields and sections by dragging them, and reposition fields like email and phone that WooCommerce places poorly by default, so you capture them earlier in the form. Remove the fields you don’t need. Opt-in & Sales Pages Send paid traffic to a dedicated landing page instead of your storefront. Build sales pages that make the case before the checkout, and squeeze pages that capture leads who aren’t ready to buy yet. Embed opt-in forms directly on the page, or open them in a lightbox (Pro). Customizable WooCommerce Thank You Pages The default thank you page looks bland and isn’t optimized to carry the conversation forward. With our highly customizable templates and widgets, you can create beautiful order confirmation pages. High-Converting Templates for Every Step Every template is thoughtfully built, imports with one click, and is optimized for mobile, tablet, and desktop. Contacts Activity Get in-depth insight into every customer, including what they bought, which offers they accepted or rejected, total spend, spend at each step and more. You can see the contacts entering your funnel and see detailed analytics in real time. What’s more? You can choose to send the contacts over to your CRM or nurture them using FunnelKit Automations – one of the most popular marketing automation and broadcast CRM for WordPress. Performance Dashboard The Performance Dashboard gives you a bird’s-eye view of all your funnels. Here’s what you can see right inside your WordPress dashboard: The total number of contacts, orders, and revenue Revenue generated per contact Best-performing funnels and pages to See the leaderboard to know what’s working and what’s not Recent activities to see a log to track the users’ actions in real time FUNNEL BUILDER PRO FEATURES Conversion Optimized WooCommerce Checkout Pages Split a long checkout form into one-, two- or three-step layouts, including a Shopify-style layout, or build a streamlined one-page checkout and dedicated order forms to sell one or several products. Apply discounts, let customers choose the exact product or variant with checkboxes or radio buttons, and build deals like buy two get one free directly at checkout. Add entirely new fields to the checkout, choosing from 14+ field types such as text, checkbox, radio, HTML and file upload. Make fields conditional so they appear only when relevant, like a company name field for business buyers or a gift message when a gift option is chosen. Edit the order summary and mini cart shown at checkout. Optimize your checkout with smart features like Google Address Autocomplete, auto-apply coupons, smart login, multistep field preview, and more. Enable WooCommerce checkout optimization to reduce cart abandonment in your store. AOV-Boosting Order Bumps Order bumps are offers shown on the WooCommerce checkout page. Customers add them to the cart with one click. Rule-based order bumps to show or skip a bump based on cart items, product category, cart total, coupons used, & more. Multiple order bumps on one checkout, shown in a slider skin. The order total updates with each bump added. Different skins and display positions to match your brand. Compatible with WooCommerce Subscriptions and Sublium (including variable subscriptions), plus membership products. Post-Purchase One-Click Upsells With post-purchase upsells, secure the immediate order before pitching other offers. Users can accept them with a single click, which boosts the store’s average order value. The friction-free purchases enhance user experience after the WooCommerce checkout page. Rule-based upsells and downsells based on item(s) bought, payment gateway used, order total & more. Dynamic Offer Paths to link offers together and show the next one based on whether the previous offer was accepted. Smart Skip to avoid offering products the customer already bought or has in the current order. Multiple upsells on a single page. Mobile-responsive, pre-built one-click upsell templates for Elementor, Bricks, Gutenberg, and other page builders. Ability to separately charge a shipping fee on the upsell product. A/B Testing Split test any page in the funnel, or the complete funnel. Does a one-page WooCommerce checkout convert better than a multi-step one? Does a single order bump beat three? A/B testing answers both. Divide the traffic and send it to different variations of your page to see which path converts best. Split test products and offers A/B test prices Compare page designs and checkout layouts Test order bumps and one-click upsells Try different headlines and sales copy In-Depth Analytics Visits, total revenue, revenue per visit, revenue per step and conversion rate for every funnel and every step, over any date range. See revenue generated from order bumps, one-click upsells and cart upsells. All Premium Templates The entire library of conversion-optimized templates, from opt-in pages to WooCommerce checkouts to thank you pages. FunnelKit Cart Included The Pro side cart comes free with your FunnelKit Plus license, with no separate purchase or license key. It includes in-cart upsells and cross-sells, free-shipping progress bars, milestone rewards and cart analytics. Works With Your Stack Themes Works with all themes including Astra, Divi, Flatsome, WoodMart, Woostify, Shoptimizer, Enfold, Rey, and any WooCommerce-compatible theme available in WordPress. Page Builders Elementor, Divi, Bricks, Oxygen, Gutenberg, and Beaver Builder. Other builders like Spectra, Avada Fusion, Cornerstone, Brizy, Thrive Architect, and Greenshift work via shortcodes. Payment Gateways Stripe, PayPal Payments, WooPayments, Mollie, Authorize.net, Mercado Pago, and more. Apple Pay, Google Pay, and Amazon Pay are supported as express checkout options. Plugins WooCommerce Subscriptions, WooCommerce Product Bundles, Advanced Coupons, EU/UK VAT Manager, WPML, Polylang, TranslatePress, LearnDash, Lifter LMS, hCaptcha, Cloudflare Turnstile, and many more. Tracking Meta Pixel & Conversions API, Google Analytics 4, Google Ads, TikTok, Pinterest, and Snapchat. Go Beyond Funnels With Marketing Automations Why stop at the sale? FunnelKit Automations is free and adds: Abandoned cart recovery sequences Live cart capture for accurate abandonment tracking Post-purchase follow-up sequences Time-delayed sends scheduled around buyer behavior Real-time reporting on abandoned carts, recovered carts, and recovered revenue It’s one of the most popular marketing automation and broadcast CRM plugins for WordPress, and it integrates directly with your FunnelKit checkout. ✅ Who Is FunnelKit Funnel Builder For? FunnelKit Funnel Builder is the ideal WordPress funnel builder and WooCommerce checkout plugin for any store or business, including: WooCommerce store owners Course creators and coaches Membership and subscription businesses Software companies Fashion and apparel brands Dropshippers Fitness coaches Authors and publishers Personal brands and bloggers Real estate professionals Educational institutions Digital product sellers 🔗 Works Great With FunnelKit Cart – A WooCommerce side cart that sends shoppers straight to your checkout, with free-shipping progress bars, milestone rewards and in-cart upsells. FunnelKit Automations – Marketing automation and CRM for WordPress. Recover abandoned checkouts, send post-purchase follow-ups and run email/SMS broadcasts. Sublium Subscriptions – Recurring payments, subscribe-and-save, memberships and installment billing, with failed-payment recovery plus MRR and churn analytics. Built by the FunnelKit team to work smoothly with your checkout. FunnelKit Payment Gateway for Stripe WooCommerce – Accept cards, Apple Pay, Google Pay and buy now, pay later options through Stripe. It’s built for FunnelKit checkouts and supports one-click upsells. FunnelKit Payment Gateway with PayPal for WooCommerce – Accept PayPal, Pay Later, Venmo and card payments using PayPal’s latest APIs, with support for subscriptions. FunnelKit Payment Gateway for Square WooCommerce – Accept Square payments in your WooCommerce store, with a secure account connection in a few clicks. External Services FunnelKit may connect to the following external services, only when the related feature is used: FunnelKit provides the template library, template images, previews and optional usage tracking. Terms and Privacy Policy Google Fonts may load when a Google font is selected. Terms and Privacy Policy Google reCAPTCHA may be used for opt-in spam prevention. Terms and Privacy Policy YouTube may embed tutorial videos on FunnelKit screens. Terms and Privacy Policy Meta may receive pixel and Conversions API events. Terms and Privacy Policy Google may receive pixel and analytics events. Terms and Privacy Policy Pinterest may receive pixel events when a tag is added. Terms and Privacy Policy Snapchat may receive pixel events when a tag is added. Terms and Privacy Policy TikTok may receive pixel events when a tag is added. Terms and Privacy Policy Source Code Unminified source for the plugin’s compiled JavaScript and CSS, along with the build configuration and build steps, is available here: https://drive.google.com/drive/folders/1Z-R0_Nbb0BOCyqauxvCftjhS9Ve–IHH
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C