WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Information

Software Type Plugin
Software Slug wpfunnels (view on wordpress.org)
Software Status Active
Software Author getwpfunnels
Software Website getwpfunnels.com
Software Downloads 621,957
Software Active Installs 5,000
Software Record Last Updated October 16, 2026

Showing 1-20 of 26 Vulnerabilities

Submit a Vulnerability
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-62029
Oct 9, 2026
Researcher: nh4tvd
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-97269
Oct 1, 2026
Researcher: Supakiad S.
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-97271
Sep 30, 2026
Researcher: daroo
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Reflected Cross-Site Scripting
6.1
CVE-2026-27371
Sep 30, 2026
Researcher: Skalucy
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
5.3
CVE-2026-84908
Sep 8, 2026
Researcher: Wordfence PRISM
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
5.3
CVE-2025-15691
Sep 4, 2026
Researcher: D01EXPLOIT OFFICIAL
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
5.3
CVE-2026-79632
Sep 4, 2026
Researcher: Sai Praneeth Koti
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Information Exposure
5.3
CVE-2026-79631
Sep 4, 2026
Researcher: Abdullah Kareem
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.12.13 - Missing Authorization
5.3
CVE-2026-84754
Sep 3, 2026
Researcher: Abdullah Kareem "cyberkareem"
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Product Price Manipulation
5.3
CVE-2026-79630
Sep 2, 2026
Researcher: Aditya Gurav
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
8.8
CVE-2026-15103
Jul 15, 2026
Researcher: Wordfence PRISM
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
6.6
CVE-2026-13080
Jul 8, 2026
Researcher: IAmNewbie
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
9.8
CVE-2026-14345
Jul 6, 2026
Researcher: thevietronin
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
6.4
CVE-2026-0626
Apr 3, 2026
Researcher: Paolo Tresso
WPFunnels <= 3.6.2 - Missing Authorization
5.3
CVE-2025-67571
Nov 15, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
6.5
CVE-2025-12000
Nov 7, 2025
Researcher: vodanh
WPFunnels <= 3.6.2 - Unauthorized User Registration
5.3
CVE-2025-12353
Nov 7, 2025
Researcher: Ahmed Rayen Ayari
WPFunnels <= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-54696
Jul 30, 2025
Researcher: Denver Jackson
WPFunnels <= 3.5.18 - Unauthenticated PHP Object Injection
9.8
CVE-2025-47530
May 12, 2025
Researcher: timomangcut
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-10792
Nov 20, 2024
Researcher: Nathaniel Oh (Calysteon)
Title Status CVE ID CVSS Researchers Date
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Unpatched CVE-2026-62029 6.4 nh4tvd October 9, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Insecure Direct Object Reference Patched CVE-2026-97269 5.3 Supakiad S. October 1, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-97271 7.2 daroo September 30, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Reflected Cross-Site Scripting Patched CVE-2026-27371 6.1 Skalucy September 30, 2026
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action Patched CVE-2026-84908 5.3 Wordfence PRISM September 8, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization Patched CVE-2025-15691 5.3 D01EXPLOIT OFFICIAL September 4, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization Patched CVE-2026-79632 5.3 Sai Praneeth Koti September 4, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Information Exposure Patched CVE-2026-79631 5.3 Abdullah Kareem September 4, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.12.13 - Missing Authorization Patched CVE-2026-84754 5.3 Abdullah Kareem "cyberkareem" September 3, 2026
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Product Price Manipulation Patched CVE-2026-79630 5.3 Aditya Gurav September 2, 2026
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter Patched CVE-2026-15103 8.8 Wordfence PRISM July 15, 2026
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter Patched CVE-2026-13080 6.6 IAmNewbie July 8, 2026
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter Patched CVE-2026-14345 9.8 thevietronin July 6, 2026
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode Patched CVE-2026-0626 6.4 Paolo Tresso April 3, 2026
WPFunnels <= 3.6.2 - Missing Authorization Patched CVE-2025-67571 5.3 Athiwat Tiprasaharn (Jitlada) November 15, 2025
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal Patched CVE-2025-12000 6.5 vodanh November 7, 2025
WPFunnels <= 3.6.2 - Unauthorized User Registration Patched CVE-2025-12353 5.3 Ahmed Rayen Ayari November 7, 2025
WPFunnels <= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-54696 6.4 Denver Jackson July 30, 2025
WPFunnels <= 3.5.18 - Unauthenticated PHP Object Injection Patched CVE-2025-47530 9.8 timomangcut May 12, 2025
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting Patched CVE-2024-10792 6.1 Nathaniel Oh (Calysteon) November 20, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation