Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: CartFlows Component: Cartflows Clear all filters
TI-2019-15254 CVE-2019-25151 · GHSA-9658-g3fh-xgf8

Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation

Priority LOW 26

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00715 Published 2023-06-07 No fix listed CWE-269
TI-2021-06622 CVE-2021-24330 · GHSA-jpx9-hmgp-grj6

Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID

Priority LOW 23

The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00652 Published 2021-06-01 Fixed in 1.6.13 CWE-79