Skip to content
OpenAdvisories

Vendor

WPFunnels

20 known vulnerabilities.

WPFunnels at a glance

Last 12 months
14
Critical · all time
3
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 1 vulnerability Dec 2025 January 2026: 1 vulnerability February 2026: 1 vulnerability March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 7 vulnerabilities, 1 critical Sep October 2026: 2 vulnerabilities, 1 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202621
Sep 202671
Aug 202600
Jul 202600
Jun 202610
May 202600
Apr 202600
Mar 202610
Feb 202610
Jan 202610
Dec 202510
Nov 202500
Oct 202500
Sep 202520
Aug 202510
Jul 202500
Jun 202500
May 202521
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

WPFunnels 8 Mail Mint 6 Creator LMS 5 WPFunnels Pro 1
All Critical High Medium Low Exploited only Public exploit

20 results · Feed

  • Critical 9.9
    CVE-2026-62129

    WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

    Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

    WPFunnels Creator LMS
  • Medium 6.5
    CVE-2026-97269

    WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.

    WPFunnels WPFunnels
  • High 7.1
    CVE-2026-97271

    WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

    WPFunnels WPFunnels
  • High 7.5
    CVE-2026-97244

    WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

    Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

    WPFunnels Creator LMS
  • Medium 5.4
    CVE-2026-62083

    WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability

    Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

    WPFunnels Creator LMS
  • High 7.1
    CVE-2026-27371

    WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

    WPFunnels WPFunnels
  • Medium 6.5
    CVE-2026-84754

    WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

    WPFunnels WPFunnels
  • Medium 6.5
    CVE-2026-84755

    WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

    WPFunnels Mail Mint
  • Critical 9.8
    CVE-2026-84753 Public exploit

    WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

    WPFunnels Mail Mint
  • High 7.1
    CVE-2026-49778

    WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

    WPFunnels WPFunnels Pro
  • High 8.8
    CVE-2026-32530

    WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <= 1.1.18.

    WPFunnels Creator LMS
  • High 7.5
    CVE-2026-23541

    WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through <= 1.19.4.

    WPFunnels Mail Mint
  • Medium 5.3
    CVE-2025-69359

    WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.

    WPFunnels Creator LMS
  • Medium 5.3
    CVE-2025-67571

    WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.

    WPFunnels WPFunnels
  • High 7.6
    CVE-2025-59570

    WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.6.

    WPFunnels Mail Mint
  • High 7.6
    CVE-2025-58604

    WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.

    WPFunnels Mail Mint
  • Medium 6.5
    CVE-2025-54696

    WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.

    WPFunnels WPFunnels
  • Critical 9.8
    CVE-2025-47530

    WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.

    WPFunnels WPFunnels
  • High 7.5
    CVE-2025-47541

    WordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through <= 1.17.7.

    WPFunnels Mail Mint
  • Medium 5.9
    CVE-2024-27965

    WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.

    WPFunnels WPFunnels