WordPress plugin
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High2
- Medium17
- Low0
All Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.8.3Update to 5.0.0 | CVE-2025-62758 | |
| Medium5.3 | Missing Authorization ≤3.8.3Update to 5.0.0 | CVE-2025-68582 | |
| High8.8 | Authenticated (Contributor+) PHP Object Injection ≤3.7.5.1No patch available | CVE-2024-10587 | |
| Medium5.3 | Missing Authorization to Unauthenticated Arbitrary Media Deletion ≤3.7.3.2Update to 3.7.4.1 | CVE-2024-5857 | |
| Medium5.3 | Missing Authorization to Unauthenticated Arbitrary Media Upload ≤3.7.3.2Update to 3.7.4.1 | CVE-2024-7447 | |
| Medium6.5 | Authenticated (Administrator+) Arbitrary File Deletion ≤3.7.3.2Update to 3.7.4.1 | CVE-2024-6312 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload ≤3.7.3.2Update to 3.7.4.1 | CVE-2024-6311 | |
| Medium4.3 | Missing Authorization to Category Update ≤3.4Update to 3.4.2 | CVE-2023-5417 | |
| Medium6.5 | Missing Authorization to Arbitrary Post Deletion ≤3.4Update to 3.4.2 | CVE-2023-5386 | |
| Medium4.3 | Missing Authorization to Test Email Sending ≤3.4Update to 3.4.2 | CVE-2023-5419 | |
| Medium4.3 | Missing Authorization to New Category Creation ≤3.4Update to 3.4.2 | CVE-2023-5415 | |
| Medium6.5 | Cross-Site Request Forgery to Arbitrary Post Deletion ≤3.4Update to 3.4.2 | CVE-2023-5382 | |
| Medium4.3 | Missing Authorization to Post Modification ≤3.4Update to 3.4.2 | CVE-2023-5411 | |
| Medium4.3 | Missing Authorization to Category Deletion ≤3.4Update to 3.4.2 | CVE-2023-5416 | |
| Medium4.3 | Cross-Site Request Forgery to Arbitrary Post Duplication ≤3.4Update to 3.4.2 | CVE-2023-5383 | |
| Medium4.3 | Missing Authorization to Arbitrary Post Duplication ≤3.4Update to 3.4.2 | CVE-2023-5385 | |
| Medium4.3 | Missing Authorization to Enable/Disable Dark Mode ≤3.4Update to 3.4.2 | CVE-2023-5387 | |
| Medium6.5 | Unauthenticated Stored Cross-Site Scripting <3.4Update to 3.4 | CVE-2023-4950 | |
| Medium6.1 | Reflected Cross-Site Scripting via fs_request_get ≤1.9.2No patch available | CVE-2023-33999 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.8.3Update to 5.0.0
- Medium5.3Missing Authorization
≤3.8.3Update to 5.0.0
- High8.8Authenticated (Contributor+) PHP Object Injection
≤3.7.5.1No patch available
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Media Deletion
≤3.7.3.2Update to 3.7.4.1
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Media Upload
≤3.7.3.2Update to 3.7.4.1
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
≤3.7.3.2Update to 3.7.4.1
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤3.7.3.2Update to 3.7.4.1
- Medium4.3Missing Authorization to Category Update
≤3.4Update to 3.4.2
- Medium6.5Missing Authorization to Arbitrary Post Deletion
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Test Email Sending
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to New Category Creation
≤3.4Update to 3.4.2
- Medium6.5Cross-Site Request Forgery to Arbitrary Post Deletion
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Post Modification
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Category Deletion
≤3.4Update to 3.4.2
- Medium4.3Cross-Site Request Forgery to Arbitrary Post Duplication
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Arbitrary Post Duplication
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Enable/Disable Dark Mode
≤3.4Update to 3.4.2
- Medium6.5Unauthenticated Stored Cross-Site Scripting
<3.4Update to 3.4
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder: common questions
Does Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 19 known vulnerabilities in Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder: 2 high, 17 medium. At least one is not fixed in the latest version.
How do I check which version of Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder vulnerability?
CVE-2025-62758, published Dec 31, 2025: Funnelforms Free <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder vulnerability listed in CISA KEV?
No. None of the known Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder vulnerabilities is currently listed in the CISA KEV catalog.