Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: FunnelKit 3.15.0.6 Clear all filters
TI-2026-11042 CVE-2026-12979 · GHSA-565q-5g57-qm5p

FunnelKit < 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template Importer

Priority MEDIUM 58

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json file…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00335 Published 2026-07-16 Fixed in 3.15.0.6 CWE-73
TI-2026-11041 CVE-2026-12978 · GHSA-j8mc-rrx2-537q

FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form

Priority MEDIUM 64

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00282 Published 2026-07-16 Fixed in 3.15.0.6 CWE-79