VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell security & vulnerabilities

wpfunnels— active installsLast vulnerability Oct 29, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
29Known vulnerabilities
  • Critical2
  • High2
  • Medium25
  • Low0
Vulnerabilities per year
2022: 2 vulnerabilities2222023: 3 vulnerabilities3232024: 2 vulnerabilities2242025: 5 vulnerabilities5252026: 17 vulnerabilities1726

All WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell vulnerabilities

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Cross-Site Request Forgery
≤3.13.5Update to 3.13.6
CVE-2026-27062
Medium5.3Missing Authorization
≤3.13.5Update to 3.13.6
CVE-2026-118088
Medium5.3Missing Authorization
≤3.13.5Update to 3.13.6
CVE-2026-118091
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.13.5Update to 3.13.6
CVE-2026-62029
Medium5.3Unauthenticated Insecure Direct Object Reference
≤3.13.1Update to 3.13.2
CVE-2026-97269
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.13.1Update to 3.13.2
CVE-2026-97271
Medium6.1Reflected Cross-Site Scripting
≤3.13.1Update to 3.13.2
CVE-2026-27371
Medium5.3Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
≤3.12.13Update to 3.13.0
CVE-2026-84908
Medium5.3Unauthenticated Information Exposure
<3.13.0Update to 3.13.0
CVE-2026-79631
Medium5.3Missing Authorization
<3.13.0Update to 3.13.0
CVE-2025-15691
Medium5.3Missing Authorization
<3.13.0Update to 3.13.0
CVE-2026-79632
Medium5.3Missing Authorization
≤3.12.13Update to 3.13.0
CVE-2026-84754
Medium5.3Unauthenticated Product Price Manipulation
<3.13.0Update to 3.13.0
CVE-2026-79630
High8.8Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
≤3.12.8Update to 3.12.9
CVE-2026-15103
Medium6.6Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
≤3.12.7Update to 3.12.8
CVE-2026-13080
Critical9.8Unauthenticated Remote Code Execution via 'postData' Parameter
≤3.12.7Update to 3.12.8
CVE-2026-14345
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
≤3.7.9Update to 3.8.0
CVE-2026-0626
Medium5.3Missing Authorization
≤3.6.2Update to 3.6.3
CVE-2025-67571
Medium6.5Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
≤3.6.2Update to 3.6.3
CVE-2025-12000
Medium5.3Unauthorized User Registration
≤3.6.2Update to 3.6.3
CVE-2025-12353
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.5.26Update to 3.5.27
CVE-2025-54696
Critical9.8Unauthenticated PHP Object Injection
≤3.5.18Update to 3.5.19
CVE-2025-47530
Medium6.1Reflected Cross-Site Scripting
≤3.5.5Update to 3.5.6
CVE-2024-10792
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.0.6Update to 3.0.7
CVE-2024-27965
Medium6.1Reflected Cross-Site Scripting
≤2.7.16Update to 2.7.17
CVE-2023-37977
Medium5.4Insecure Direct Object Reference
<2.7.16Update to 2.7.16
—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde
≤2.6.8Update to 2.6.9
CVE-2023-0173
Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
—
Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
CVE-2022-47150

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: common questions

Does WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell have known vulnerabilities?

Yes. VulnCrest Radar lists 29 known vulnerabilities in WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: 2 critical, 2 high, 25 medium. At least one is not fixed in the latest version.

How do I check which version of WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell vulnerability?

CVE-2026-27062, published Oct 29, 2026: WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).

Is any WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell vulnerability listed in CISA KEV?

No. None of the known WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?