Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2026-49778

WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2026-84908

WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell Wordpress
CVE-2026-79632

WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2026-79630

WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2026-79631

WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2026-15103

WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell Wordpress
CVE-2026-13080

WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

CVSS 3.1 · 6.6 Medium EPSS 1.2% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell Wordpress
CVE-2026-14345

WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell Wordpress
CVE-2026-0626

WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode

The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell Wordpress
CVE-2025-54696

WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2024-27965

WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels
Products
Wpfunnels
CVE-2025-12353

WPFunnels <= 3.6.2 - Unauthorized User Registration

The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2025-12000

WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal

The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2025-67571

WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels Wordpress
Products
Wpfunnels Wordpress
CVE-2023-37977

WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin <= 2.7.16 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Getwpfunnels
Products
Wpfunnels