# CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Unauthenticated Arbitrary Shortcode Execution via Checkout, Optin and Thank You Page Output

- **ID:** WPSEC-2026-2256
- **Plugin:** CartFlows – Funnel Builder & Checkout Plugin for WooCommerce (`cartflows`), https://wordpress.org/plugins/cartflows/
- **Affected versions:** all versions before 3.3.1
- **Fixed in:** 3.3.1 (Update to 3.3.1 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cartflows
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2256/

## Description

The CartFlows plugin for WordPress is vulnerable to arbitrary shortcode execution via the checkout, optin and thank you page output in all versions up to, and including, 3.3.0. The plugin puts customer-controlled data into the markup of its checkout, optin and order details shortcodes without neutralizing shortcode brackets. That data includes checkout field values pre-filled from URL query parameters (any parameter name was accepted), WooCommerce notices such as an unknown coupon code, and order details. When these shortcodes are rendered through the plugin's blocks or page builder widgets, their output is processed for shortcodes a second time. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

## References

- https://wpsec.com/vuln/WPSEC-2026-2256/
- https://plugins.svn.wordpress.org/cartflows/tags/3.3.1/
- https://wordpress.org/plugins/cartflows/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2256/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.