What’s Vulnerable › Products

WPFunnels vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your WPFunnels version is affected

Latest WPFunnels vulnerabilities

• CVE-2026-97269 — WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
• CVE-2026-97271 — WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-27371 — WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-84754 — WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability (CVSS 6.5)
• CVE-2025-67571 — WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-54696 — WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-47530 — WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability (CVSS 9.8)
• CVE-2024-27965 — WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
• CVE-2023-37977 — WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)