WPFunnels

Records19All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

WPFunnels records in CISA KEV

No WPFunnels vulnerabilities are listed in CISA KEV.

Records

19 records

TI-2026-58254 CVE-2026-84753 · GHSA-28vg-wv39-3g8h

WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-09-03 No fix listed CWE-502

TI-2025-30027 CVE-2025-47530 · GHSA-3f9c-xxj6-82v8

WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-05-23 No fix listed CWE-502

TI-2026-70421 CVE-2026-62129 · GHSA-gj5p-w6rg-7h28

Arbitrary file upload in Creator LMS plugin for WordPress

MEDIUM 42

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00259 Published 2026-10-10 No fix listed CWE-434

TI-2026-25058 CVE-2026-32530 · GHSA-vj36-gx8h-q66m

WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability

MEDIUM 40

Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <= 1.1.18.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00234 Published 2026-03-25 No fix listed CWE-266

TI-2026-18963 CVE-2026-23541 · GHSA-vr5h-3wp5-6cwh

WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through <= 1.19.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00333 Published 2026-02-19 No fix listed CWE-862

TI-2025-30038 CVE-2025-47541 · GHSA-qwmp-5m8m-pjvf

WordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure Vulnerability

LOW 39

Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through <= 1.17.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00472 Published 2025-05-23 No fix listed CWE-201

TI-2026-63985 CVE-2026-97244 · GHSA-r9h2-gpr8-x9mm

WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

LOW 35

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00289 Published 2026-09-30 No fix listed CWE-35

TI-2026-58255 CVE-2026-84754 · GHSA-9qgm-4h5v-4xxp

WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability

LOW 35

Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2026-09-03 No fix listed CWE-862

TI-2026-64004 CVE-2026-97269 · GHSA-h8hq-r6h2-qpc4

WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability

LOW 34

Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00194 Published 2026-10-01 No fix listed CWE-639

TI-2026-58256 CVE-2026-84755 · GHSA-rgfp-fq6c-cg7q

WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability

LOW 34

Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00266 Published 2026-09-03 No fix listed CWE-862

TI-2025-37100 CVE-2025-59570 · GHSA-4ghw-4rqj-464x

WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection Vulnerability

LOW 33

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.6.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00355 Published 2025-09-22 No fix listed CWE-89

TI-2025-36272 CVE-2025-58604 · GHSA-4prh-9c92-2qcm

WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection Vulnerability

LOW 33

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00355 Published 2025-09-03 No fix listed CWE-89

TI-2026-64006 CVE-2026-97271 · GHSA-w7fw-rqc4-46cg

WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-09-30 No fix listed CWE-79

TI-2026-36687 CVE-2026-49778 · GHSA-6gg7-jg4m-rf53

WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00186 Published 2026-06-17 No fix listed CWE-79

TI-2026-21787 CVE-2026-27371 · GHSA-8rm7-v54j-x3c5

WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-09-30 No fix listed CWE-79

TI-2025-42802 CVE-2025-69359 · GHSA-27xq-wwxh-hrf6

WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00267 Published 2026-01-06 No fix listed CWE-862

TI-2025-41325 CVE-2025-67571 · GHSA-gfhx-j544-rw6j

WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00247 Published 2025-12-09 No fix listed CWE-862

TI-2025-34459 CVE-2025-54696 · GHSA-vmfr-hp39-gvrw

WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00242 Published 2025-08-14 No fix listed CWE-79

TI-2026-44371 CVE-2026-62083 · GHSA-q5q4-c7v6-r6xm

WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability

LOW 24

Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00233 Published 2026-09-30 No fix listed CWE-1284

Open these records in search →

Critical	3
High	9
Medium	7
Low	0
No CVSS	0