Advisories · Technology

WPFunnels.

Every CVE that names WPFunnels among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-27062 CVE record

CVSS 4.3 Medium

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability
- WPFunnels
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2026
CVE-2026-118088 CVE record

CVSS 5.3 Medium

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
- WPFunnels
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-118091 CVE record

CVSS 5.3 Medium

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
- WPFunnels
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-62029 CVE record

CVSS 6.5 Medium

WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
Not analysed yet 9 Oct 2026
CVE-2026-97269 CVE record

CVSS 6.5 Medium

WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability
- WPFunnels
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-97271 CVE record

CVSS 7.1 High

WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-27371 CVE record

CVSS 7.1 High

WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-79632 CVE record

CVSS 5.3 Medium

WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission
- WPFunnels
- Broken access control
Not analysed yet 4 Sept 2026
CVE-2026-79631 CVE record

CVSS 5.3 Medium

WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files
- WPFunnels
- Information disclosure
Not analysed yet 4 Sept 2026
CVE-2026-79630 CVE record

CVSS 5.3 Medium

WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
- WPFunnels
- Broken access control
Not analysed yet 4 Sept 2026
CVE-2025-15691 CVE record

CVSS 5.3 Medium

WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms
- WPFunnels
- Broken access control
Not analysed yet 4 Sept 2026
CVE-2026-84754 CVE record

CVSS 6.5 Medium

WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability
- WPFunnels
- Broken access control
Not analysed yet 3 Sept 2026
CVE-2025-67571 CVE record

CVSS 5.3 Medium

WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability
- WPFunnels
- Broken access control
Not analysed yet 9 Dec 2025
CVE-2025-54696 CVE record

CVSS 6.5 Medium

WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
Not analysed yet 14 Aug 2025
CVE-2025-47530 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability
- WPFunnels
- Insecure deserialization
Not analysed yet 23 May 2025
CVE-2024-27965 CVE record

CVSS 5.9 Medium

WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
Not analysed yet 21 Mar 2024