Extension WordPress
Vulnérabilités FunnelKit – Funnel Builder for WooCommerce Checkout
Cette page rassemble les failles publiées pour FunnelKit – Funnel Builder for WooCommerce Checkout, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de FunnelKit – Funnel Builder for WooCommerce Checkout
16 fiches
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.8 – Unauthenticated Stored Cross-Site Scripting
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.15.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-3.15.0.8
3.15.0.9
10/07/2026
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.5 – Authenticated (Administrator+) SQL Injection
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.15.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
*-3.15.0.5
3.15.0.6
24/06/2026
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 – Unauthenticated Stored Cross-Site Scripting
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.15.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-3.15.0.2
3.15.0.3
03/06/2026
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.1 – Unauthenticated SQL Injection
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.15.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
*-3.15.0.1
3.15.0.2
27/04/2026
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 – Unauthenticated SQL Injection
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied…
*-3.13.1.5
3.13.1.6
11/12/2025
Funnel Builder by FunnelKit <= 3.13.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Funnel Builder by FunnelKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.13.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
*-3.13.1.2
3.13.1.3
06/12/2025
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wfop_phone` shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output…
*-3.13.1.2
3.13.1.3
18/11/2025
FunnelKit <= 3.12.0 – Reflected Cross-Site Scripting
The FunnelKit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
*-3.12.0
3.12.0.1
15/10/2025
Funnel Builder by FunnelKit <= 3.11.1 – Unauthenticated Local File Inclusion
The Funnel Builder by FunnelKit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.11.1. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing…
*-3.11.1
3.12.0
19/08/2025
Multiple Plugins By FunnelKit <= (Various Versions) – Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library
Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may…
*-3.11.0.2
3.11.1
18/08/2025
Funnel Builder by FunnelKit <= 3.10.2 – Authenticated (Administrator+) SQL Injection
The Funnel Builder by FunnelKit plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.10.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
*-3.10.2
3.11.0
08/07/2025
Funnel Builder for WordPress by FunnelKit <= 3.10.1 – Authenticated (Administrator+) SQL Injection
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.10.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…
*-3.10.1
3.10.2
07/04/2025
Funnel Builder by FunnelKit <= 3.9.0 – Unauthenticated Local File Inclusion
The Funnel Builder by FunnelKit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.9.0. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing…
*-3.9.0
3.9.1
23/02/2025
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 – Missing Authorization to Authenticated (Contributor+) Settings Update
The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on…
*-3.4.6
3.4.7
23/07/2024
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 – Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ parameter in all versions up…
*-3.3.1
3.4.0
28/06/2024
Funnel Builder for WordPress by FunnelKit <= 2.14.3 – Authenticated(Administrator+) SQL Injection
The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.14.4 (exclusive) due to insufficient escaping on…
[*, 2.14.4)
2.14.4
21/12/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.