Read the docs

CartFlows

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

CartFlows records in CISA KEV

No CartFlows vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cartflows 4 records LOW Woocommerce Cart Abandonment Recovery 1 record MEDIUM

Records

6 records

TI-2024-02158 CVE-2024-2322 · GHSA-rfj8-v7wf-3hfc

WooCommerce Cart Abandonment Recovery < 1.2.27 - Templates/Abandoned Orders Deletion via CSRF

Priority MEDIUM 63

The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as dele…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00353 Published 2024-04-03 Fixed in 1.2.27 CWE-352
TI-2019-15254 CVE-2019-25151 · GHSA-9658-g3fh-xgf8

Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation

Priority LOW 26

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00715 Published 2023-06-07 No fix listed CWE-269
TI-2021-06622 CVE-2021-24330 · GHSA-jpx9-hmgp-grj6

Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID

Priority LOW 23

The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00652 Published 2021-06-01 Fixed in 1.6.13 CWE-79
Open these records in search →