Vulnerabilities

TI-2026-70421 CVE-2026-62129 · GHSA-gj5p-w6rg-7h28

Arbitrary file upload in Creator LMS plugin for WordPress

MEDIUM 42

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00259 Published 2026-10-10 No fix listed CWE-434

TI-2026-64004 CVE-2026-97269 · GHSA-h8hq-r6h2-qpc4

WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability

LOW 34

Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00194 Published 2026-10-01 No fix listed CWE-639

TI-2026-64006 CVE-2026-97271 · GHSA-w7fw-rqc4-46cg

WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-09-30 No fix listed CWE-79

TI-2026-63985 CVE-2026-97244 · GHSA-r9h2-gpr8-x9mm

WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

LOW 35

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00289 Published 2026-09-30 No fix listed CWE-35

TI-2026-44371 CVE-2026-62083 · GHSA-q5q4-c7v6-r6xm

WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability

LOW 24

Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00233 Published 2026-09-30 No fix listed CWE-1284

TI-2026-21787 CVE-2026-27371 · GHSA-8rm7-v54j-x3c5

WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-09-30 No fix listed CWE-79

TI-2026-58256 CVE-2026-84755 · GHSA-rgfp-fq6c-cg7q

WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability

LOW 34

Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00266 Published 2026-09-03 No fix listed CWE-862

TI-2026-58255 CVE-2026-84754 · GHSA-9qgm-4h5v-4xxp

WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability

LOW 35

Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2026-09-03 No fix listed CWE-862

TI-2026-58254 CVE-2026-84753 · GHSA-28vg-wv39-3g8h

WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-09-03 No fix listed CWE-502

TI-2026-36687 CVE-2026-49778 · GHSA-6gg7-jg4m-rf53

WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00186 Published 2026-06-17 No fix listed CWE-79

TI-2026-25058 CVE-2026-32530 · GHSA-vj36-gx8h-q66m

WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability

MEDIUM 40

Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <= 1.1.18.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00234 Published 2026-03-25 No fix listed CWE-266

TI-2026-18963 CVE-2026-23541 · GHSA-vr5h-3wp5-6cwh

WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through <= 1.19.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00333 Published 2026-02-19 No fix listed CWE-862

TI-2025-42802 CVE-2025-69359 · GHSA-27xq-wwxh-hrf6

WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00267 Published 2026-01-06 No fix listed CWE-862

TI-2025-41325 CVE-2025-67571 · GHSA-gfhx-j544-rw6j

WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00247 Published 2025-12-09 No fix listed CWE-862

TI-2025-37100 CVE-2025-59570 · GHSA-4ghw-4rqj-464x

WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection Vulnerability

LOW 33

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.6.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00355 Published 2025-09-22 No fix listed CWE-89

TI-2025-36272 CVE-2025-58604 · GHSA-4prh-9c92-2qcm

WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection Vulnerability

LOW 33

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00355 Published 2025-09-03 No fix listed CWE-89

TI-2025-34459 CVE-2025-54696 · GHSA-vmfr-hp39-gvrw

WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00242 Published 2025-08-14 No fix listed CWE-79

TI-2025-30027 CVE-2025-47530 · GHSA-3f9c-xxj6-82v8

WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-05-23 No fix listed CWE-502

TI-2025-30038 CVE-2025-47541 · GHSA-qwmp-5m8m-pjvf

WordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure Vulnerability

LOW 39

Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through <= 1.17.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00472 Published 2025-05-23 No fix listed CWE-201

Vulnerabilities

Filters