Funnelkit (Unknown) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-07-16. Vendor: Unknown.

CVEs of Funnelkit

• CVE-2026-12979 - CVSS 5.5 (medium), 2026-07-16: The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing…
• CVE-2026-12978 - CVSS 7.1 (high), 2026-07-16: The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its…
• CVE-2025-10567 - CVSS 6.3 (medium), 2025-11-05: The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing…
• CVE-2025-2203 - CVSS 6.1 (medium), 2025-05-15: The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL…