cleantalk
Vulnerabilities and Security Researches

Vulnerabilities and security researches forwpfunnels wpfunnels

Direction: ascending
Jun 06, 2024

Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2023-0173

CVE, Research URL

CVE-2023-0173

Date
Feb 07, 2023
Research Description
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected versions
max 2.6.9.
Status
vulnerable

Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels # CVE-2024-27965

CVE, Research URL

CVE-2024-27965

Date
Mar 21, 2024
Research Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.
Affected versions
max 3.0.7.
Status
vulnerable

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2023-37977

CVE, Research URL

CVE-2023-37977

Date
Jul 27, 2023
Research Description
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin <= 2.7.16 versions.
Affected versions
max 2.7.17.
Status
vulnerable
Nov 22, 2024

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2024-10792

CVE, Research URL

CVE-2024-10792

Date
Nov 21, 2024
Research Description
The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This was partially patched in 3.5.4 and fully patched in 3.5.5.
Affected versions
max 3.5.6.
Status
vulnerable
May 16, 2025

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2025-47530

CVE, Research URL

CVE-2025-47530

Date
May 23, 2025
Research Description
Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.
Affected versions
max 3.5.19.
Status
vulnerable
Aug 06, 2025

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2025-54696

CVE, Research URL

CVE-2025-54696

Date
Aug 14, 2025
Research Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.
Affected versions
max 3.5.27.
Status
vulnerable
Dec 10, 2025

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2025-12353

CVE, Research URL

CVE-2025-12353

Date
Nov 08, 2025
Research Description
The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.
Affected versions
max 3.6.3.
Status
vulnerable

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2025-12000

CVE, Research URL

CVE-2025-12000

Date
Nov 08, 2025
Research Description
The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected versions
max 3.6.3.
Status
vulnerable
Apr 14, 2026

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2026-0626

CVE, Research URL

CVE-2026-0626

Date
Apr 04, 2026
Research Description
The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
max 3.8.0.
Status
vulnerable
Jun 13, 2026

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2025-67571

CVE, Research URL

CVE-2025-67571

Date
Dec 09, 2025
Research Description
Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.
Affected versions
max 3.6.3.
Status
vulnerable
Jun 16, 2026

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # 0aa20d31bd7bc666eb413a15b7cb604aec386407

Date
Jul 10, 2023
Research Description
WPFunnels – Funnel Builder for WooCommerce with Checkout &amp; One Click Upsell [wpfunnels] < 2.7.16 WPFunnels <= 2.7.15 - Insecure Direct Object Reference The WPFunnels plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 2.7.15. This is due to insufficient validation on a user controlled key. This makes it possible for authenticated attackers to perform actions on objects they aren't intended to manipulate.
Affected versions
max 2.7.16.
Status
vulnerable

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # 9119d408d992cc723bc71ee66e3266067619b486

Date
Jul 13, 2023
Research Description
WPFunnels – Funnel Builder for WooCommerce with Checkout &amp; One Click Upsell [wpfunnels] < 2.7.17 WPFunnels <= 2.7.16 - Reflected Cross-Site Scripting The WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order_id parameter in versions up to, and including, 2.7.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions
max 2.7.17.
Status
vulnerable

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # 3fac323480c620013050ad9e6a563f7b7ff18c8d

Date
Jul 11, 2023
Research Description
WPFunnels – Funnel Builder for WooCommerce with Checkout &amp; One Click Upsell [wpfunnels] < 2.7.16 WordPress Drag & Drop Sales Funnel Builder for WordPress – WPFunnels Plugin < 2.7.16 is vulnerable to Insecure Direct Object References (IDOR) No patched version available. Unknown discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress Drag & Drop Sales Funnel Builder for WordPress – WPFunnels Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has not been known to be fixed yet.
Affected versions
max 2.7.16.
Status
vulnerable
Jul 08, 2026

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2026-14345

CVE, Research URL

CVE-2026-14345

Date
Jul 07, 2026
Research Description
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.
Affected versions
max 3.12.8.
Status
vulnerable
Jul 10, 2026

Easiest Sales Funnel Builder For WordPress &amp; WooCommerce by WPFunnels # CVE-2026-13080

CVE, Research URL

CVE-2026-13080

Date
Jul 09, 2026
Research Description
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected versions
max 3.12.8.
Status
vulnerable