CVE-2024-5192 Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

🗓️ 29 Jun 2024 04:33:27Reported by WordfenceType

Funnel Builder for WordPress plugin <= 3.3.1 - Authenticated Stored Cross-Site Scripting via SVG Uploa

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin Funnel Builder for WordPress by FunnelKit security vulnerability	29 Jun 202400:00	–	cnnvd
CVE	CVE-2024-5192	29 Jun 202404:33	–	cve
EUVD	EUVD-2024-46435	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5192	29 Jun 202405:15	–	nvd
OSV	CVE-2024-5192	29 Jun 202405:15	–	osv
Patchstack	WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)	1 Jul 202400:00	–	patchstack
Patchstack	WordPress Funnel Builder for WordPress by FunnelKit plugin <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload vulnerability	1 Jul 202403:46	–	patchstack
Positive Technologies	PT-2024-35051 · Funnelkit · The Funnel Builder For Wordpress By Funnelkit	29 Jun 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-5192	23 May 202508:29	–	redhatcve
Vulnrichment	CVE-2024-5192 Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload	29 Jun 202404:33	–	vulnrichment

[
  {
    "vendor": "amans2k",
    "product": "FunnelKit – Funnel Builder for WooCommerce Checkout",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3107500/
plugins	www.plugins.trac.wordpress.org/browser/funnel-builder/trunk/modules/checkouts/includes/class-wfacp-common-helper.php
plugins	www.plugins.trac.wordpress.org/browser/funnel-builder/tags/3.3.1/modules/checkouts/includes/class-wfacp-common.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2b77703e-b3d3-4105-a162-0afe86d5b3eb

08 Apr 2026 16:43Current

CVSS 3.16.4

EPSS0.00233

CWE-79