Skip to content
Noroxi

WPFunnels

wpfunnels · plugin

Known security vulnerabilities for WPFunnels. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

2 critical · latest Oct 1, 2026

Vulnerabilities

  • CVE-2026-14345

    WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter

    Critical 9.8

  • CVE-2025-47530

    WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability

    Critical 9.8

  • CVE-2026-15103

    WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter

    High 8.8

  • CVE-2026-97271

    WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-27371

    WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-13080

    WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter

    Medium 6.6

  • CVE-2026-97269

    WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability

    Medium 6.5

  • CVE-2026-84754

    WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2025-12000

    WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal

    Medium 6.5

  • CVE-2025-54696

    WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-0626

    WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode

    Medium 6.4

  • CVE-2024-10792

    Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2023-37977

    WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2026-84908

    WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action

    Medium 5.3

  • CVE-2025-67571

    WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2025-12353

    WPFunnels <= 3.6.2 - Unauthorized User Registration

    Medium 5.3

  • CVE-2024-27965

    WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

← Back to directory