getwpfunnels vulnerabilities
17 published CVEs name getwpfunnels among the affected products.
- Published CVEs
- 17
- Last 12 months
- 16
- Critical
- 2
- Known exploited
- 0
Critical 2High 3Medium 12Low 0Not scored 0
CVEs per yearBy the year they were published
- 20241
- 20253
- 202613
Newest CVEs
- CVE-2026-111106
Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter
getwpfunnels · Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
Medium6.5 - CVE-2026-84908
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
getwpfunnels · WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Medium5.3 - CVE-2026-19800
Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter
getwpfunnels · Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Medium4.9 - CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
getwpfunnels · Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Critical9.8 - CVE-2026-15103
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
getwpfunnels · WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
High8.8 - CVE-2026-12918
Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter
getwpfunnels · Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Medium4.9 - CVE-2026-14342
Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter
getwpfunnels · Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Medium4.9 - CVE-2026-13080
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
getwpfunnels · WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Medium6.6 - CVE-2026-14345
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
getwpfunnels · WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Critical9.8 - CVE-2026-0626
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
getwpfunnels · WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Medium6.4
Products with the most CVEs
Most common weaknesses
- CWE-89 SQL injection5
- CWE-434 Unrestricted file upload2
- CWE-79 Cross-site scripting (XSS)2
- CWE-862 Missing authorization2
- CWE-22 Path traversal1
- CWE-269 Improper privilege management1
- CWE-352 Cross-site request forgery (CSRF)1
- CWE-502 Deserialization of untrusted data1
- CWE-639 Authorization bypass through a user-controlled key (IDOR)1
- CWE-98 PHP remote file inclusion1