CVEs we hold for Wpfunnels

Records whose assigning authority named Wpfunnels as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-97271WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerabilityWPFunnels

CVE-2026-97269WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerabilityWPFunnels

CVE-2026-97244WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerabilityWPFunnels Creator LMS

CVE-2026-84755WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerabilityWPFunnels Mail Mint

CVE-2026-84754WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerabilityWPFunnels

CVE-2026-84753WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerabilityWPFunnels Mail Mint

CVE-2026-79632WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submissionUnknown WPFunnels

CVE-2026-79631WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log FilesUnknown WPFunnels

CVE-2026-79630WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID SubstitutionUnknown WPFunnels

CVE-2026-62129WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerabilityWPFunnels Creator LMS

CVE-2026-62083WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerabilityWPFunnels Creator LMS

CVE-2026-62029WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerabilityWPFunnels

CVE-2026-49778WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerabilityWPFunnels Pro

CVE-2026-32530WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerabilityWPFunnels Creator LMS

CVE-2026-27371WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerabilityWPFunnels

CVE-2026-27349WordPress Mail Mint plugin <= 1.19.5 - Sensitive Data Exposure vulnerabilityWPFunnels Team Mail Mint

CVE-2026-23541WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerabilityWPFunnels Mail Mint

CVE-2026-104386WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerabilityWPFunnels Team WP VR

CVE-2025-69359WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerabilityWPFunnels Creator LMS

CVE-2025-67571WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerabilityWPFunnels

CVE-2025-59570WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection VulnerabilityWPFunnels Mail Mint

CVE-2025-58604WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection VulnerabilityWPFunnels Mail Mint

CVE-2025-54696WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerabilityWPFunnels

CVE-2025-47541WordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure VulnerabilityWPFunnels Mail Mint

CVE-2025-47530WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection VulnerabilityWPFunnels

CVE-2025-15691WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in FormsUnknown WPFunnels

CVE-2024-27965WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityWPFunnels

CVE-2023-37977WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS)WPFunnels

28 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.