Skip to content
Noroxi

Funnelforms Free – Interactive Contact Form and Multi Step Form Builder

funnelforms-free · plugin

Known security vulnerabilities for Funnelforms Free – Interactive Contact Form and Multi Step Form Builder. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

5 exploitable without logging in · latest Dec 31, 2025

Closed on wordpress.org

Removed from the directory on Feb 25, 2026 · reason: guideline violation. A closed component gets no more updates; installed copies keep running and their vulnerabilities stay open. Remove it or replace it with a maintained alternative.

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-10587contributor+≤ 3.7.5.1

    Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection

    High 8.8

  • CVE-2024-6311admin≤ 3.7.3.2

    Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload

    High 7.2

  • CVE-2025-62758login required≤ 3.8

    WordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-6312admin≤ 3.7.3.2

    Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion

    Medium 6.5

  • CVE-2025-68582unauthenticated≤ 3.8

    WordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-5857unauthenticated≤ 3.7.3.2

    Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary

    Medium 5.3

  • CVE-2024-7447unauthenticated≤ 3.7.3.2

    Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary

    Medium 5.3

  • CVE-2023-5383unauthenticated · needs a click≤ 3.4

    Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication

    Medium 4.3

  • CVE-2023-5382unauthenticated · needs a click≤ 3.4

    Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion

    Medium 4.3

  • CVE-2023-5419subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending

    Medium 4.3

  • CVE-2023-5417subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to Category Update

    Medium 4.3

  • CVE-2023-5416subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion

    Medium 4.3

  • CVE-2023-5415subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation

    Medium 4.3

  • CVE-2023-5411subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to Post Modification

    Medium 4.3

  • CVE-2023-5387subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode

    Medium 4.3

  • CVE-2023-5386subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion

    Medium 4.3

  • CVE-2023-5385subscriber+≤ 3.4

    Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory