WordPress Plugin Funnel Builder for WordPress by FunnelKit SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Funnel...

WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL Injection

Software Funnel Builder for WordPress by FunnelKit Type Plugin Vulnerable versions = 2.14.3 Fixed in 2.14.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50856 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID b73a1107b7a1 Credits Muhammad Daffa Requir...

WordPress 5 Stars Rating Funnel Plugin <= 1.2.63 is vulnerable to Cross Site Scripting (XSS)

Software 5 Stars Rating Funnel Type Plugin Vulnerable versions = 1.2.63 Fixed in 1.2.64 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Tobias PSID b28e41895b77 Credits Rafie Muhammad Patchstack Require...

WordPress WooCommerce Checkout & Funnel Builder Plugin < 1.5.16 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cartflows:funnelbuilder"; ifdescription...

CVE-2020-36736 WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass

The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15. This is due to missing or incorrect nonce validation on the exportjson, importjson, and statuslogsfile functions. This makes it possibl...

CVE-2020-36736

CVE-2020-36736 affects the WordPress plugin WooCommerce Checkout & Funnel Builder by CartFlows (versions up to 1.5.15). The root cause is missing or incorrect nonce validation on export_json, import_json, and status_logs_file functions, enabling Cross-Site Request Forgery. This can allow unauthen...

CVE-2019-25151

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activateplugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service...

CVE-2019-25151

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activateplugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service...

Authorization

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activateplugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service...

CVE-2019-25151

The CVE-2019-25151 issue affects the Funnel Builder plugin for WordPress, specifically versions up to and including 1.3.0. The root cause is a missing capability check in the activate_plugin function, which enables an authenticated attacker to bypass authorization and activate any plugin on the v...

CVE-2019-25151 Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activateplugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service...

CVE-2019-25151 Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activateplugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service...

PT-2023-11378 · WordPress · Funnel Builder

Name of the Vulnerable Software and Affected Versions: Funnel Builder plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to authorization bypass due to a missing capability check on the activate plugin function. This allows authenticated attackers to...

WordPress Plugin Funnel Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-0173

The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

Cross site scripting

The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

MAL-2022-6051 Malicious code in sfdc-funnel-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 316089f2b90b5fe73ad3851e5d26f1b289aebe6b4f28413faaf534e7b486dc71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sfdc-funnel-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 316089f2b90b5fe73ad3851e5d26f1b289aebe6b4f28413faaf534e7b486dc71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi

Description The plugin does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtnggdeleteleads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using...

5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi

Description The plugin does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtnggdeleteleads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using...