GE
Vendor
getwpfunnels
20
CVEs
0
On KEV
1
New 30D
Products
MM6.5
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
getwpfunnels
1 CVEs0 on KEV1 new
WF9.8
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
getwpfunnels
8 CVEs0 on KEV0 new
MM9.8
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
getwpfunnels
7 CVEs0 on KEV0 new
WP6.1
Wpfunnels
Getwpfunnels
2 CVEs0 on KEV0 new
CL8.8
Creator LMS – Online Courses and eLearning Plugin
getwpfunnels
1 CVEs0 on KEV0 new
DD5.4
Drag & Drop Sales Funnel Builder
Getwpfunnels
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111106 | MM Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance getwpfunnels | 6.5 | Oct 16 | Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter |
| CVE-2026-84908 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 5.3 | Sep 9 | WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action |
| CVE-2026-19800 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 4.9 | Sep 9 | Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter |
| CVE-2026-10196 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 9.8 | Sep 5 | Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields |
| CVE-2026-15103 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 8.8 | Jul 16 | WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter |
| CVE-2026-12918 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 4.9 | Jul 10 | Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter |
| CVE-2026-14342 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 4.9 | Jul 9 | Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter |
| CVE-2026-13080 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 6.6 | Jul 9 | WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter |
| CVE-2026-14345 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 9.8 | Jul 7 | WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter |
| CVE-2026-0626 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 6.4 | Apr 4 | WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode |
| CVE-2026-1258 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 4.9 | Feb 14 | Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints |
| CVE-2026-1447 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 5.4 | Feb 3 | Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting |
| CVE-2025-15347 | CL Creator LMS – Online Courses and eLearning Plugin getwpfunnels | 8.8 | Jan 20 | Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update |
| CVE-2025-11967 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 7.2 | Nov 8 | Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload |
| CVE-2025-12000 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 6.5 | Nov 8 | WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal |
| CVE-2025-12353 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 5.3 | Nov 8 | WPFunnels <= 3.6.2 - Unauthorized User Registration |
| CVE-2024-10792 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 6.1 | Nov 21 | Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting |
| CVE-2024-27965 | WP Wpfunnels Getwpfunnels | 4.8 | Mar 21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through… |
| CVE-2023-37977 | WP Wpfunnels Getwpfunnels | 6.1 | Jul 27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin <= 2.7.16 versions |
| CVE-2023-0173 | DD Drag & Drop Sales Funnel Builder Getwpfunnels | 5.4 | Feb 6 | The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |