WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Information

Software Type Plugin
Software Slug wpfunnels (view on wordpress.org)
Software Status Active
Software Author getwpfunnels
Software Website getwpfunnels.com
Software Downloads 589,099
Software Active Installs 5,000
Software Record Last Updated July 22, 2026

16 Vulnerabilities

Submit a Vulnerability
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
8.8
CVE-2026-15103
Jul 15, 2026
Researcher: PRISM
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
6.6
CVE-2026-13080
Jul 8, 2026
Researcher: IAmNewbie
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
9.8
CVE-2026-14345
Jul 6, 2026
Researcher: thevietronin
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
6.4
CVE-2026-0626
Apr 3, 2026
Researcher: Paolo Tresso
WPFunnels <= 3.6.2 - Missing Authorization
5.3
CVE-2025-67571
Nov 15, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
6.5
CVE-2025-12000
Nov 7, 2025
Researcher: vodanh
WPFunnels <= 3.6.2 - Unauthorized User Registration
5.3
CVE-2025-12353
Nov 7, 2025
Researcher: Ahmed Rayen Ayari
WPFunnels <= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-54696
Jul 30, 2025
Researcher: Denver Jackson
WPFunnels <= 3.5.18 - Unauthenticated PHP Object Injection
9.8
CVE-2025-47530
May 12, 2025
Researcher: timomangcut
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-10792
Nov 20, 2024
Researcher: Nathaniel Oh (Calysteon)
WPFunnels <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-27965
Mar 13, 2024
Researcher: hye0ngseok
WPFunnels <= 2.7.16 - Reflected Cross-Site Scripting
6.1
CVE-2023-37977
Jul 13, 2023
Researcher: LEE SE HYOUNG
WPFunnels <= 2.7.15 - Insecure Direct Object Reference
5.4
CVE ID Unknown
Jul 10, 2023
Researchers:
WPFunnels <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde
6.4
CVE-2023-0173
Jan 11, 2023
Researcher: István Márton
Appsero <= 1.2.1 - Missing Authorization
4.3
CVE ID Unknown
Dec 16, 2022
Researchers:
Appsero <= 1.2.0 - Cross-Site Request Forgery
4.3
CVE-2022-47150
Dec 14, 2022
Researcher: István Márton
Title Status CVE ID CVSS Researchers Date
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter Patched CVE-2026-15103 8.8 PRISM July 15, 2026
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter Patched CVE-2026-13080 6.6 IAmNewbie July 8, 2026
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter Patched CVE-2026-14345 9.8 thevietronin July 6, 2026
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode Patched CVE-2026-0626 6.4 Paolo Tresso April 3, 2026
WPFunnels <= 3.6.2 - Missing Authorization Patched CVE-2025-67571 5.3 Athiwat Tiprasaharn (Jitlada) November 15, 2025
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal Patched CVE-2025-12000 6.5 vodanh November 7, 2025
WPFunnels <= 3.6.2 - Unauthorized User Registration Patched CVE-2025-12353 5.3 Ahmed Rayen Ayari November 7, 2025
WPFunnels <= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-54696 6.4 Denver Jackson July 30, 2025
WPFunnels <= 3.5.18 - Unauthenticated PHP Object Injection Patched CVE-2025-47530 9.8 timomangcut May 12, 2025
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting Patched CVE-2024-10792 6.1 Nathaniel Oh (Calysteon) November 20, 2024
WPFunnels <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2024-27965 4.4 hye0ngseok March 13, 2024
WPFunnels <= 2.7.16 - Reflected Cross-Site Scripting Patched CVE-2023-37977 6.1 LEE SE HYOUNG July 13, 2023
WPFunnels <= 2.7.15 - Insecure Direct Object Reference Patched 5.4 July 10, 2023
WPFunnels <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde Patched CVE-2023-0173 6.4 István Márton January 11, 2023
Appsero <= 1.2.1 - Missing Authorization Patched 4.3 December 16, 2022
Appsero <= 1.2.0 - Cross-Site Request Forgery Patched CVE-2022-47150 4.3 István Márton December 14, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation