Vulnerabilities

TI-2026-83284 CVE-2026-39738 · GHSA-9cg4-h688-392x

PHP object injection in WordPress FunnelKit Automations plugin

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00408 Published 2026-10-30 No fix listed CWE-502

TI-2026-81963 CVE-2026-111411 · GHSA-xxrj-fj77-w6c3

SQL injection in WordPress FunnelKit Automations plugin

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automation…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00342 Published 2026-10-28 No fix listed CWE-89

TI-2026-80296 CVE-2026-111841 · GHSA-8hx4-3v93-jhgx

WordPress FunnelKit Automations plugin cross-site request forgery vulnerability

LOW 39

Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0013 Published 2026-10-26 No fix listed CWE-352

TI-2026-67993 CVE-2026-40807 · GHSA-ghjf-jxmv-h956

Cross-site scripting in CF7 Views for Contact Form 7 plugin

LOW 30

Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-10-06 No fix listed CWE-79

TI-2026-64678 CVE-2026-100513 · GHSA-97w4-4q94-v224

Cross-site scripting in Aman CF7 Views – Complete Entry Management for Contact Form…

LOW 28

Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00156 Published 2026-09-30 No fix listed CWE-79

TI-2026-41348 CVE-2026-57411 · GHSA-97wf-886r-mrvf

Cross-site scripting in Aman CF7 Views – Complete Entry Management for Contact Form…

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views – Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-13 No fix listed CWE-79

TI-2026-28427 CVE-2026-39450 · GHSA-cpw9-rv4g-g54v

WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability

LOW 31

Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00385 Published 2026-06-15 No fix listed CWE-288

TI-2026-30965 CVE-2026-42742 · GHSA-7mfx-xwxr-fq6r

WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00223 Published 2026-05-12 No fix listed CWE-89

TI-2026-30964 CVE-2026-42741 · GHSA-rvq8-mhp5-38gf

SQL injection in Aman Ninja Forms Views – Display & Edit Ninja Forms…

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00223 Published 2026-05-12 No fix listed CWE-89

TI-2025-40592 CVE-2025-66067 · GHSA-cp5g-45qq-c596

WordPress Funnel Builder by FunnelKit plugin <= 3.13.1.2 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows DOM-Based XSS.This issue affects Funnel Builder by FunnelKit: f…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0021 Published 2025-11-21 No fix listed CWE-79

TI-2025-39707 CVE-2025-64264 · GHSA-pw27-m89x-8r2x

WordPress Popup addon for Ninja Forms plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows Stored XSS.This issue affects Popup addon for Ninj…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00177 Published 2025-11-13 No fix listed CWE-79

TI-2025-34513 CVE-2025-54750 · GHSA-hpxq-8x6r-hqm2

WordPress Funnel Builder by FunnelKit Plugin <= 3.11.1 - Local File Inclusion Vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00629 Published 2025-08-20 No fix listed CWE-98

TI-2025-31149 CVE-2025-49034 · GHSA-w67h-gv22-9whv

WordPress Funnel Builder by FunnelKit plugin <= 3.10.2 - SQL Injection vulnerability

LOW 33

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: f…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00338 Published 2025-07-16 No fix listed CWE-89

TI-2025-33246 CVE-2025-53279 · GHSA-cw9w-wmfh-fgfv

WordPress Popup addon for Ninja Forms plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows DOM-Based XSS.This issue affects Popup addon for N…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00236 Published 2025-06-27 No fix listed CWE-79

TI-2025-31783 CVE-2025-49868 · GHSA-mc9q-wxrx-p966

WordPress Automation By Autonami plugin <= 3.6.0 - Open Redirection Vulnerability

LOW 21

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.6.0.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00232 Published 2025-06-17 No fix listed CWE-601

TI-2025-22065 CVE-2025-30795 · GHSA-63x6-9wf8-mmhm

WordPress Automation By Autonami plugin <= 3.5.1 - Open Redirection vulnerability

LOW 22

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.5.1.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00402 Published 2025-03-27 No fix listed CWE-601

TI-2025-19850 CVE-2025-26979 · GHSA-pq7h-pvch-xwc2

WordPress Funnel Builder by FunnelKit plugin <= 3.9.0 - Local File Inclusion vulnerability

LOW 34

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.008 Published 2025-02-25 No fix listed CWE-98

Vulnerabilities

Filters