Vulnerabilities and security researches forwpfunnels wpfunnels
Direction: ascendingEasiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2023-0173
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Feb 07, 2023
- Research Description
- The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Affected versions
-
max 2.6.9.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2024-27965
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Mar 21, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.
- Affected versions
-
max 3.0.7.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2023-37977
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Jul 27, 2023
- Research Description
- Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin <= 2.7.16 versions.
- Affected versions
-
max 2.7.17.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2024-10792
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Nov 21, 2024
- Research Description
- The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This was partially patched in 3.5.4 and fully patched in 3.5.5.
- Affected versions
-
max 3.5.6.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2025-47530
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- May 23, 2025
- Research Description
- Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.
- Affected versions
-
max 3.5.19.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2025-54696
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Aug 14, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.
- Affected versions
-
max 3.5.27.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2025-12353
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Nov 08, 2025
- Research Description
- The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.
- Affected versions
-
max 3.6.3.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2025-12000
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Nov 08, 2025
- Research Description
- The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Affected versions
-
max 3.6.3.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2026-0626
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Apr 04, 2026
- Research Description
- The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 3.8.0.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2025-67571
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Dec 09, 2025
- Research Description
- Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.
- Affected versions
-
max 3.6.3.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # 0aa20d31bd7bc666eb413a15b7cb604aec386407
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Jul 10, 2023
- Research Description
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels] < 2.7.16 WPFunnels <= 2.7.15 - Insecure Direct Object Reference The WPFunnels plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 2.7.15. This is due to insufficient validation on a user controlled key. This makes it possible for authenticated attackers to perform actions on objects they aren't intended to manipulate.
- Affected versions
-
max 2.7.16.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # 9119d408d992cc723bc71ee66e3266067619b486
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Jul 13, 2023
- Research Description
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels] < 2.7.17 WPFunnels <= 2.7.16 - Reflected Cross-Site Scripting The WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order_id parameter in versions up to, and including, 2.7.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 2.7.17.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # 3fac323480c620013050ad9e6a563f7b7ff18c8d
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Jul 11, 2023
- Research Description
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels] < 2.7.16 WordPress Drag & Drop Sales Funnel Builder for WordPress – WPFunnels Plugin < 2.7.16 is vulnerable to Insecure Direct Object References (IDOR) No patched version available. Unknown discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress Drag & Drop Sales Funnel Builder for WordPress – WPFunnels Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has not been known to be fixed yet.
- Affected versions
-
max 2.7.16.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2026-14345
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Jul 07, 2026
- Research Description
- The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.
- Affected versions
-
max 3.12.8.
- Status
-
vulnerable
Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2026-13080
- CVE, Research URL
- Home page URL
-
Security reports for Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels
- Date
- Jul 09, 2026
- Research Description
- The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Affected versions
-
max 3.12.8.
- Status
-
vulnerable