Vulnerabilities

TI-2025-01932 CVE-2025-2203 · GHSA-8xj4-6h2f-28vg

WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection

HIGH 68

The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00271 Published 2025-05-15 Fixed in 3.10.2 CWE-89

TI-2024-00977 CVE-2024-1056 · GHSA-qrcm-99p5-fwr8

Cross-site scripting in FunnelKit Funnel Builder Pro

LOW 28

The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the 'wp_kses_allowed_html' filter to globally allow script and ifr…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-08-29 No fix listed CWE-79

TI-2024-06339 CVE-2024-6836 · GHSA-j9gf-9w7p-ww7f

Missing authorization in FunnelKit – Funnel Builder for WooCommerce Checkout

LOW 20

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00323 Published 2024-07-24 No fix listed CWE-862

TI-2024-04818 CVE-2024-5192 · GHSA-m8p4-qc4v-39j2

Cross-site scripting in FunnelKit – Funnel Builder for WooCommerce Checkout

LOW 28

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00329 Published 2024-06-29 No fix listed CWE-79

TI-2023-27761 CVE-2023-50856 · GHSA-cgf4-3952-w724

WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL Injection

LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Max…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00541 Published 2023-12-28 No fix listed CWE-89