Read the docs

teamfunnelkit

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

teamfunnelkit records in CISA KEV

No teamfunnelkit vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-83500 CVE-2026-119163 · GHSA-3h7v-9626-9c6v

Unauthenticated SQL injection in FunnelKit Automations plugin

Priority LOW 39

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and inclu…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00304 Published 2026-10-31 No fix listed CWE-89
TI-2026-75165 CVE-2026-107746 · GHSA-fjvp-gr2j-2xrc

Missing authorization in FunnelKit exposes WooCommerce order billing data

Priority LOW 39

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a us…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00318 Published 2026-10-16 No fix listed CWE-862
TI-2026-70220 CVE-2026-100147 · GHSA-x8hv-gh93-vrwq

FunnelKit Unauthenticated Stored Cross-Site Scripting via Order Fields

Priority LOW 31

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insu…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00297 Published 2026-10-10 No fix listed CWE-79
Open these records in search →