What’s Vulnerable › Products

amans2k FunnelKit – Funnel Builder for WooCommerce Checkout vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your amans2k FunnelKit – Funnel Builder for WooCommerce Checkout version is affected

Latest amans2k FunnelKit – Funnel Builder for WooCommerce Checkout vulnerabilities

• CVE-2025-14169 — FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection (CVSS 7.5)
• CVE-2025-12878 — FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode (CVSS 6.4)
• CVE-2025-7654 — Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library (CVSS 8.8)
• CVE-2025-2203 — WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection (CVSS 6.1)
• CVE-2024-1056 — Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post (CVSS 5.4)
• CVE-2024-6836 — Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update (CVSS 4.3)
• CVE-2024-5192 — Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 5.4)
• CVE-2023-50856 — WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL Injection (CVSS 7.2)