CVE-2025-26979 WordPress Funnel Builder by FunnelKit plugin <= 3.9.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through = 3.9.0...

CVE-2025-26979

CVE-2025-26979 is an authenticated-free Local File Inclusion (LFI) vulnerability in FunnelKit Funnel Builder for WooCommerce Checkout, affecting Funnel Builder by FunnelKit up to version 3.9.0. The initial description identifies an Improper Control of Filename for Include/Require in PHP, describe...

PT-2025-7876

Name of the Vulnerable Software and Affected Versions FunnelKit Funnel Builder versions through 3.9.0 Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP Local...

WordPress plugin Funnel Builder by FunnelKit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-26979: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through = 3.9.0...

WordPress Funnel Builder by FunnelKit plugin <= 3.9.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Funnel Builder by FunnelKit versions = 3.9.0...

CVE-2024-11938

The One Click Upsell Funnel for WooCommerce – Funnel Builder for WordPress, Create WooCommerce Upsell, Post-Purchase Upsell & Cross Sell Offers that Boost Sales & Increase Profits with Sales Funnel Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's...

WordPress plugin Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Easiest Funnel Build...

CVE-2024-10792: Improper Neutralization of Input During Web Page Generation

The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-1056 Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post

The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowiframetaginpost' function which uses the 'wpksesallowedhtml' filter to globally allow script and iframe tags in posts in all versions up to, and including, 3.4.5. This makes it possibl...

WordPress Funnel Kit Funnel Builder PRO plugin <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post vulnerability

WordPress Funnel Kit Funnel Builder PRO plugin = 3.4.5 AuthenticatedContributor+ Stored Cross-Site Scripting via allowiframetaginpost vulnerability discovered by Francesco Carlucci in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.4.5...

WordPress plugin Funnel Kit Funnel Builder PRO 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress Funnel Kit Funnel Builder PRO Plugin <= 3.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Funnel Kit Funnel Builder PRO Type Plugin Vulnerable versions = 3.4.5 Fixed in 3.5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1056 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8c1faa8fa285 Credits Francesco...

CVE-2024-1056: Improper Neutralization of Input During Web Page Generation

The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowiframetaginpost' function which uses the 'wpksesallowedhtml' filter to globally allow script and iframe tags in posts in all versions up to, and including, 3.4.5. This makes it possibl...

CVE-2024-6836

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and...

CVE-2024-6836

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and...

CVE-2024-6836 Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and...

WordPress Funnel Builder for WordPress by FunnelKit plugin <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update vulnerability

Missing Authorization to Authenticated Contributor+ Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin Funnel Builder by FunnelKit versions = 3.4.6...

WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 3.4.6 is vulnerable to Broken Access Control

Software Funnel Builder for WordPress by FunnelKit Type Plugin Vulnerable versions = 3.4.6 Fixed in 3.4.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6836 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f7a411b5f336 Credits Luci...

PT-2024-37895 · Funnelkit · The Funnel Builder For Wordpress

Name of the Vulnerable Software and Affected Versions: The Funnel Builder for WordPress by FunnelKit versions up to, and including, 3.4.6 Description: The issue allows authenticated attackers with Contributor-level access and above to update multiple settings due to a missing capability check on...