WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce

Information

Software Type Plugin
Software Slug cartflows (view on wordpress.org)
Software Status Active
Software Author cartflowswp
Software Website cartflows.com
Software Downloads 6,791,517
Software Active Installs 200,000
Software Record Last Updated April 24, 2024

5 Vulnerabilities

Funnel Builder by CartFlows <= 2.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via settings
5.5
CVE-2024-29813
Mar 25, 2024
Researcher: LVT-tholv2k
CartFlows <= 1.11.11 - Insecure Direct Object Reference to Arbitrary Post Deletion
2.7
CVE ID Unknown
Jun 2, 2023
Researchers:
Funnel Builder by CartFlows <= 1.6.12 - Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID
4.8
CVE-2021-24330
May 17, 2021
Researcher: Vladislav Pokrovsky (ΞX.MI)
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass
4.3
CVE-2020-36736
Sep 26, 2020
Researcher: Jerome Bruandet
Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation
5.4
CVE-2019-25151
Nov 7, 2019
Researcher: Jerome Bruandet
Title CVE ID CVSS Researchers Date
Funnel Builder by CartFlows <= 2.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via settings CVE-2024-29813 5.5 LVT-tholv2k March 25, 2024
CartFlows <= 1.11.11 - Insecure Direct Object Reference to Arbitrary Post Deletion 2.7 June 2, 2023
Funnel Builder by CartFlows <= 1.6.12 - Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID CVE-2021-24330 4.8 Vladislav Pokrovsky (ΞX.MI) May 17, 2021
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass CVE-2020-36736 4.3 Jerome Bruandet September 26, 2020
Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation CVE-2019-25151 5.4 Jerome Bruandet November 7, 2019

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation