Vulnerabilities / WPFunnels
WPFunnels vulnerabilities
Advisories WPSec published for WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell. Other sources may list more. Its attack surface: WPFunnels on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-01 | WPSEC-2026-0174 | WPFunnels <= 3.13.1 - Reflected Cross-Site Scripting via 'per_page' Parameter | Medium 6.1 | 3.13.2 |
| 2026-10-01 | WPSEC-2026-0173 | WPFunnels <= 3.13.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Bump Settings | Medium 6.4 | 3.13.2 |
License: CC BY 4.0