Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

WordPress security records

WordPress Vulnerability Listing

Filter Production Feed records and inspect affected software, version ranges, severity, patch information and source attribution without opening separate UUID pages.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

Clear filters

16 vulnerability records

HighCVE-2026-15103

WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.12.8

Vulnerability type: CWE-269 Improper Privilege Management

Affected software, patched versions and attribution

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.12.8

Patched versions: 3.12.9

Researcher credit: Wordfence PRISM

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 15, 2026
CVSS
8.8
MediumCVE-2026-13080

WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.12.7

Vulnerability type: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Affected software, patched versions and attribution

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.12.7

Patched versions: 3.12.8

Researcher credit: IAmNewbie

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 8, 2026
CVSS
6.6
CriticalCVE-2026-14345

WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.12.7

Vulnerability type: CWE-434 Unrestricted Upload of File with Dangerous Type

Affected software, patched versions and attribution

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.12.7

Patched versions: 3.12.8

Researcher credit: thevietronin

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 6, 2026
CVSS
9.8
MediumCVE-2026-0626

WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.7.9

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.7.9

Patched versions: 3.8.0

Researcher credit: Paolo Tresso

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
April 3, 2026
CVSS
6.4
MediumCVE-2025-67571

WPFunnels <= 3.6.2 - Missing Authorization

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.6.2

Vulnerability type: CWE-862 Missing Authorization

Affected software, patched versions and attribution

The Easy WordPress Funnel Builder To Collect Leads And Increase Sales – WPFunnels plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.6.2

Patched versions: 3.6.3

Researcher credit: Athiwat Tiprasaharn (Jitlada)

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
November 15, 2025
CVSS
5.3
MediumCVE-2025-12000

WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.6.2

Vulnerability type: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected software, patched versions and attribution

The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.6.2

Patched versions: 3.6.3

Researcher credit: vodanh

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
November 7, 2025
CVSS
6.5
MediumCVE-2025-12353

WPFunnels <= 3.6.2 - Unauthorized User Registration

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.6.2

Vulnerability type: CWE-639 Authorization Bypass Through User-Controlled Key

Affected software, patched versions and attribution

The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.6.2

Patched versions: 3.6.3

Researcher credit: Ahmed Rayen Ayari

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
November 7, 2025
CVSS
5.3
MediumCVE-2025-54696

WPFunnels <= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.5.26

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The WPFunnels plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.5.26

Patched versions: 3.5.27

Researcher credit: Denver Jackson

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 30, 2025
CVSS
6.4
CriticalCVE-2025-47530

WPFunnels <= 3.5.18 - Unauthenticated PHP Object Injection

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.5.18

Vulnerability type: CWE-502 Deserialization of Untrusted Data

Affected software, patched versions and attribution

The WPFunnels plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.5.18 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.5.18

Patched versions: 3.5.19

Researcher credit: timomangcut

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
May 12, 2025
CVSS
9.8
MediumCVE-2024-10792

Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.5.5

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This was partially patched in 3.5.4 and fully patched in 3.5.5.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.5.5

Patched versions: 3.5.6

Researcher credit: Nathaniel Oh (Calysteon)

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
November 20, 2024
CVSS
6.1
MediumCVE-2024-27965

WPFunnels <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-3.0.6

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Easiest Sales Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-3.0.6

Patched versions: 3.0.7

Researcher credit: hye0ngseok

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
March 13, 2024
CVSS
4.4
MediumCVE-2023-37977

WPFunnels <= 2.7.16 - Reflected Cross-Site Scripting

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-2.7.16

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order_id parameter in versions up to, and including, 2.7.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-2.7.16

Patched versions: 2.7.17

Researcher credit: LEE SE HYOUNG

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 13, 2023
CVSS
6.1
Medium

WPFunnels <= 2.7.15 - Insecure Direct Object Reference

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: [*, 2.7.16)

Vulnerability type: CWE-639 Authorization Bypass Through User-Controlled Key

Affected software, patched versions and attribution

The WPFunnels plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 2.7.15. This is due to insufficient validation on a user controlled key. This makes it possible for authenticated attackers to perform actions on objects they aren't intended to manipulate.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: [*, 2.7.16)

Patched versions: 2.7.16

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 10, 2023
CVSS
5.4
MediumCVE-2023-0173

WPFunnels <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatched

Affected versions: *-2.6.8

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The WPFunnels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-2.6.8

Patched versions: 2.6.9

Researcher credit: István Márton

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
January 11, 2023
CVSS
6.4
Medium

Appsero <= 1.2.1 - Missing Authorization

PT Addons for Elementor Lite: Currently marked unpatchedSubscribe2 – Form, Email Subscribers & Newsletters: Currently marked unpatchedwePOS – Point Of Sale (POS) for WooCommerce & Dokan: Currently marked unpatchedEasy Video Reviews – Testimonial Grid & Social Proof: Currently marked unpatchedWorth The Read: Currently marked unpatchedWoostify Sites Library: Currently marked unpatchedFlexTable – Data Table Sync with Google Sheets: Currently marked unpatchedPost Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: Currently marked unpatchedWPEPP – Essential Security, Password Protect & Login Page Customizer: Currently marked unpatchedProduct Carousel Slider & Grid Ultimate for WooCommerce: Currently marked unpatchedProduct Gallery Slider, Additional Variation Images for WooCommerce: Currently marked unpatchedMarkdown Editor (Formerly Dark Mode): Currently marked unpatchedProject Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker: Currently marked unpatchedDashboard Welcome for Elementor: Currently marked unpatchedWP Dark Mode – Improve Accessibility with AI Powered Dark Theme: Currently marked unpatchedFuse Social Floating Sidebar: Currently marked unpatchedStylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator: Currently marked unpatchedSlider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider: Currently marked unpatchedProduct Category Slider for WooCommerce: Currently marked unpatchedFlexMeeting – Webinar & Meeting Plugin for Jitsi Meet: Currently marked unpatchedW4 Post List: Currently marked unpatchedweMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce: Currently marked unpatchedBuddyPress Builder for Elementor – BuddyBuilder: Currently marked unpatchedLegal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator: Currently marked unpatchedHappy Addons for Elementor: Currently marked unpatchedWP VR – 360 Panorama and Virtual Tour Builder: Currently marked unpatchedConversion Tracking for WooCommerce: Currently marked unpatchedSolid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews: Currently marked unpatchedEasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time: Currently marked unpatchedweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Currently marked unpatchedBangladeshi Payment Gateways – Make Payment Using QR Code: Currently marked unpatchedTexty – SMS Notification for WordPress, WooCommerce, Dokan and more: Currently marked unpatchedVisibility Logic for Elementor: Currently marked unpatchedPDF Invoices & Packing Slips for WooCommerce – Challan: Currently marked unpatchedDarklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin: Currently marked unpatchedExclusive Team for Elementor: Currently marked unpatchedClick to top: Currently marked unpatchedUpdate Image Tag Alt Attribute: Currently marked unpatchedMagical Posts Display – Elementor Advanced Posts widgets: Currently marked unpatchedGS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets: Currently marked unpatchedWP Mail Logging: Currently marked unpatchedDirectorist: AI-Powered Business Directory, Listings & Classified Ads: Currently marked unpatchedUser Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration: Currently marked unpatchedExclusive Addons for Elementor: Currently marked unpatchedBoostify Header Footer Builder for Elementor: Currently marked unpatchedStax Addons for Elementor: Currently marked unpatchedWP CTA – Call Now Button, Sticky Button & Call to Action Builder: Currently marked unpatchedGallery Box: Currently marked unpatchedPrime Elementor Addons – Lightweight Elementor Widgets for Faster Pages: Currently marked unpatchedWiremo – Product Reviews for WooCommerce: Currently marked unpatchedCart Lift – Abandoned Cart Recovery for WooCommerce and EDD: Currently marked unpatchedWPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatchedProduct Category Showcase for WooCommerce: Currently marked unpatched

Affected versions: *-2.2; *-10.37; *-1.2.5; *-1.4.2; *-1.14; *-1.4.3; *-2.12.14; *-1.6.3

Vulnerability type: CWE-862 Missing Authorization

Affected software, patched versions and attribution

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function intended for administrator use.

PT Addons for Elementor Lite

Affected versions: *-2.2

Patched versions: Not supplied

Subscribe2 – Form, Email Subscribers & Newsletters

Affected versions: *-10.37

Patched versions: 10.38

wePOS – Point Of Sale (POS) for WooCommerce & Dokan

Affected versions: *-1.2.5

Patched versions: 1.2.6

Easy Video Reviews – Testimonial Grid & Social Proof

Affected versions: *-1.4.2

Patched versions: 1.5.0

Worth The Read

Affected versions: *-1.14

Patched versions: 1.14.1

Woostify Sites Library

Affected versions: *-1.4.3

Patched versions: 1.4.4

FlexTable – Data Table Sync with Google Sheets

Affected versions: *-2.12.14

Patched versions: 2.12.15

Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget

Affected versions: *-1.6.3

Patched versions: 1.6.4

WPEPP – Essential Security, Password Protect & Login Page Customizer

Affected versions: *-1.2.3

Patched versions: 1.2.4

Product Carousel Slider & Grid Ultimate for WooCommerce

Affected versions: *-1.9.3

Patched versions: 1.9.4

Product Gallery Slider, Additional Variation Images for WooCommerce

Affected versions: *-2.2.6

Patched versions: 2.2.7

Markdown Editor (Formerly Dark Mode)

Affected versions: *-4.1.2

Patched versions: 4.1.3

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

Affected versions: *-2.6.12

Patched versions: 2.6.13

Dashboard Welcome for Elementor

Affected versions: *-1.0.6

Patched versions: 1.0.7

WP Dark Mode – Improve Accessibility with AI Powered Dark Theme

Affected versions: *-3.0.4

Patched versions: 3.0.5

Fuse Social Floating Sidebar

Affected versions: *-5.4.6

Patched versions: 5.4.7

Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator

Affected versions: *-7.3.6

Patched versions: 7.3.7

Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider

Affected versions: *-3.28.0

Patched versions: 3.28.1

Product Category Slider for WooCommerce

Affected versions: *-4.1.5

Patched versions: 4.1.6

FlexMeeting – Webinar & Meeting Plugin for Jitsi Meet

Affected versions: *-1.2.5

Patched versions: 2.0.0

W4 Post List

Affected versions: *-2.4.2

Patched versions: 2.4.3

weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce

Affected versions: *-1.14.1

Patched versions: 1.14.2

BuddyPress Builder for Elementor – BuddyBuilder

Affected versions: *-1.7.1

Patched versions: 1.7.2

Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator

Affected versions: *-1.4.1

Patched versions: 1.4.2

Happy Addons for Elementor

Affected versions: *-3.8.2

Patched versions: 3.8.3

WP VR – 360 Panorama and Virtual Tour Builder

Affected versions: *-8.2.5

Patched versions: 8.2.6

Conversion Tracking for WooCommerce

Affected versions: *-2.0.10

Patched versions: 2.0.11

Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews

Affected versions: *-1.9.7

Patched versions: 1.9.8

EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time

Affected versions: *-1.0.9

Patched versions: 1.1.0

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot

Affected versions: 1.6-1.7.5

Patched versions: 1.7.6

Bangladeshi Payment Gateways – Make Payment Using QR Code

Affected versions: *-2.0.6

Patched versions: 2.0.7

Texty – SMS Notification for WordPress, WooCommerce, Dokan and more

Affected versions: *-1.1.1

Patched versions: 1.1.2

Visibility Logic for Elementor

Affected versions: *-2.3.3

Patched versions: 2.3.4

PDF Invoices & Packing Slips for WooCommerce – Challan

Affected versions: *-3.4.8

Patched versions: 3.4.9

Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin

Affected versions: *-2.1.1

Patched versions: 2.1.2

Exclusive Team for Elementor

Affected versions: *-1.2.4

Patched versions: Not supplied

Click to top

Affected versions: *-1.2.19

Patched versions: 1.2.20

Update Image Tag Alt Attribute

Affected versions: *-2.4.3

Patched versions: Not supplied

Magical Posts Display – Elementor Advanced Posts widgets

Affected versions: *-1.2.15

Patched versions: 1.2.16

GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets

Affected versions: *-1.6.2

Patched versions: 1.6.3

WP Mail Logging

Affected versions: 1.10.5

Patched versions: 1.11.0

Directorist: AI-Powered Business Directory, Listings & Classified Ads

Affected versions: *-7.7.1

Patched versions: 7.7.2

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration

Affected versions: *-3.6.0

Patched versions: 3.6.1

Exclusive Addons for Elementor

Affected versions: *-2.6.1

Patched versions: 2.6.2

Boostify Header Footer Builder for Elementor

Affected versions: *-1.2.8

Patched versions: 1.2.9

Stax Addons for Elementor

Affected versions: *-1.4.3

Patched versions: 1.4.4

WP CTA – Call Now Button, Sticky Button & Call to Action Builder

Affected versions: *-1.5.8

Patched versions: 1.5.9

Gallery Box

Affected versions: *-1.7.30

Patched versions: 1.7.31

Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages

Affected versions: *-1.0.1

Patched versions: 1.0.2

Wiremo – Product Reviews for WooCommerce

Affected versions: *-1.4.96

Patched versions: 1.4.97

Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD

Affected versions: *-3.1.3

Patched versions: 3.1.4

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: *-2.6.4

Patched versions: 2.6.5

Product Category Showcase for WooCommerce

Affected versions: *-1.1.9

Patched versions: 2.0.0

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
December 16, 2022
CVSS
4.3
MediumCVE-2022-47150

Appsero <= 1.2.0 - Cross-Site Request Forgery

PT Addons for Elementor Lite: Currently marked unpatchedSubscribe2 – Form, Email Subscribers & Newsletters: Currently marked unpatchedwePOS – Point Of Sale (POS) for WooCommerce & Dokan: Currently marked unpatchedEasy Video Reviews – Testimonial Grid & Social Proof: Currently marked unpatchedWorth The Read: Currently marked unpatchedWoostify Sites Library: Currently marked unpatchedFlexTable – Data Table Sync with Google Sheets: Currently marked unpatchedPost Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: Currently marked unpatchedWPEPP – Essential Security, Password Protect & Login Page Customizer: Currently marked unpatchedProduct Carousel Slider & Grid Ultimate for WooCommerce: Currently marked unpatchedProduct Gallery Slider, Additional Variation Images for WooCommerce: Currently marked unpatchedMarkdown Editor (Formerly Dark Mode): Currently marked unpatchedProject Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker: Currently marked unpatchedDashboard Welcome for Elementor: Currently marked unpatchedWP Dark Mode – Improve Accessibility with AI Powered Dark Theme: Currently marked unpatchedFuse Social Floating Sidebar: Currently marked unpatchedStylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator: Currently marked unpatchedSlider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider: Currently marked unpatchedProduct Category Slider for WooCommerce: Currently marked unpatchedFlexMeeting – Webinar & Meeting Plugin for Jitsi Meet: Currently marked unpatchedW4 Post List: Currently marked unpatchedweMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce: Currently marked unpatchedBuddyPress Builder for Elementor – BuddyBuilder: Currently marked unpatchedLegal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator: Currently marked unpatchedHappy Addons for Elementor: Currently marked unpatchedWP VR – 360 Panorama and Virtual Tour Builder: Currently marked unpatchedConversion Tracking for WooCommerce: Currently marked unpatchedSolid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews: Currently marked unpatchedEasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time: Currently marked unpatchedweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Currently marked unpatchedBangladeshi Payment Gateways – Make Payment Using QR Code: Currently marked unpatchedTexty – SMS Notification for WordPress, WooCommerce, Dokan and more: Currently marked unpatchedVisibility Logic for Elementor: Currently marked unpatchedPDF Invoices & Packing Slips for WooCommerce – Challan: Currently marked unpatchedDarklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin: Currently marked unpatchedExclusive Team for Elementor: Currently marked unpatchedClick to top: Currently marked unpatchedUpdate Image Tag Alt Attribute: Currently marked unpatchedMagical Posts Display – Elementor Advanced Posts widgets: Currently marked unpatchedGS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets: Currently marked unpatchedWP Mail Logging: Currently marked unpatchedDirectorist: AI-Powered Business Directory, Listings & Classified Ads: Currently marked unpatchedUser Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration: Currently marked unpatchedZero BS Accounting: Currently marked unpatchedExclusive Addons for Elementor: Currently marked unpatchedBoostify Header Footer Builder for Elementor: Currently marked unpatchedStax Addons for Elementor: Currently marked unpatchedWP CTA – Call Now Button, Sticky Button & Call to Action Builder: Currently marked unpatchedGallery Box: Currently marked unpatchedPrime Elementor Addons – Lightweight Elementor Widgets for Faster Pages: Currently marked unpatchedWiremo – Product Reviews for WooCommerce: Currently marked unpatchedCart Lift – Abandoned Cart Recovery for WooCommerce and EDD: Currently marked unpatchedWPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Currently marked unpatchedProduct Category Showcase for WooCommerce: Currently marked unpatched

Affected versions: *-2.2; *-10.37; *-1.2.5; *-1.4.2; *-1.14; *-1.4.3; *-2.12.14; *-1.6.3

Vulnerability type: CWE-352 Cross-Site Request Forgery (CSRF)

Affected software, patched versions and attribution

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function intended for administrator use via forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

PT Addons for Elementor Lite

Affected versions: *-2.2

Patched versions: Not supplied

Subscribe2 – Form, Email Subscribers & Newsletters

Affected versions: *-10.37

Patched versions: 10.38

wePOS – Point Of Sale (POS) for WooCommerce & Dokan

Affected versions: *-1.2.5

Patched versions: 1.2.6

Easy Video Reviews – Testimonial Grid & Social Proof

Affected versions: *-1.4.2

Patched versions: 1.5.0

Worth The Read

Affected versions: *-1.14

Patched versions: 1.14.1

Woostify Sites Library

Affected versions: *-1.4.3

Patched versions: 1.4.4

FlexTable – Data Table Sync with Google Sheets

Affected versions: *-2.12.14

Patched versions: 2.12.15

Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget

Affected versions: *-1.6.3

Patched versions: 1.6.4

WPEPP – Essential Security, Password Protect & Login Page Customizer

Affected versions: *-1.2.3

Patched versions: 1.2.4

Product Carousel Slider & Grid Ultimate for WooCommerce

Affected versions: *-1.9.3

Patched versions: 1.9.4

Product Gallery Slider, Additional Variation Images for WooCommerce

Affected versions: *-2.2.6

Patched versions: 2.2.7

Markdown Editor (Formerly Dark Mode)

Affected versions: *-4.1.2

Patched versions: 4.1.3

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

Affected versions: *-2.6.12

Patched versions: 2.6.13

Dashboard Welcome for Elementor

Affected versions: *-1.0.6

Patched versions: 1.0.7

WP Dark Mode – Improve Accessibility with AI Powered Dark Theme

Affected versions: *-3.0.4

Patched versions: 3.0.5

Fuse Social Floating Sidebar

Affected versions: *-5.4.6

Patched versions: 5.4.7

Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator

Affected versions: *-7.3.6

Patched versions: 7.3.7

Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider

Affected versions: *-3.28.0

Patched versions: 3.28.1

Product Category Slider for WooCommerce

Affected versions: *-4.1.5

Patched versions: 4.1.6

FlexMeeting – Webinar & Meeting Plugin for Jitsi Meet

Affected versions: *-1.2.5

Patched versions: 2.0.0

W4 Post List

Affected versions: *-2.4.2

Patched versions: 2.4.3

weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce

Affected versions: *-1.14.1

Patched versions: 1.14.2

BuddyPress Builder for Elementor – BuddyBuilder

Affected versions: *-1.7.1

Patched versions: 1.7.2

Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator

Affected versions: *-1.4.1

Patched versions: 1.4.2

Happy Addons for Elementor

Affected versions: *-3.8.2

Patched versions: 3.8.3

WP VR – 360 Panorama and Virtual Tour Builder

Affected versions: *-8.2.5

Patched versions: 8.2.6

Conversion Tracking for WooCommerce

Affected versions: *-2.0.10

Patched versions: 2.0.11

Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews

Affected versions: *-1.9.7

Patched versions: 1.9.8

EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time

Affected versions: *-1.0.9

Patched versions: 1.1.0

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot

Affected versions: 1.6-1.7.5

Patched versions: 1.7.6

Bangladeshi Payment Gateways – Make Payment Using QR Code

Affected versions: *-2.0.6

Patched versions: 2.0.7

Texty – SMS Notification for WordPress, WooCommerce, Dokan and more

Affected versions: *-1.1.1

Patched versions: 1.1.2

Visibility Logic for Elementor

Affected versions: *-2.3.3

Patched versions: 2.3.4

PDF Invoices & Packing Slips for WooCommerce – Challan

Affected versions: *-3.4.8

Patched versions: 3.4.9

Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin

Affected versions: *-2.1.1

Patched versions: 2.1.2

Exclusive Team for Elementor

Affected versions: *-1.2.4

Patched versions: Not supplied

Click to top

Affected versions: *-1.2.19

Patched versions: 1.2.20

Update Image Tag Alt Attribute

Affected versions: *-2.4.3

Patched versions: Not supplied

Magical Posts Display – Elementor Advanced Posts widgets

Affected versions: *-1.2.15

Patched versions: 1.2.16

GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets

Affected versions: *-1.6.2

Patched versions: 1.6.3

WP Mail Logging

Affected versions: *-1.10.5

Patched versions: 1.11.0

Directorist: AI-Powered Business Directory, Listings & Classified Ads

Affected versions: *-7.7.1

Patched versions: 7.7.2

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration

Affected versions: *-3.6.0

Patched versions: 3.6.1

Zero BS Accounting

Affected versions: *-1.0.6

Patched versions: 2.0.0

Exclusive Addons for Elementor

Affected versions: *-2.6.1

Patched versions: 2.6.2

Boostify Header Footer Builder for Elementor

Affected versions: *-1.2.8

Patched versions: 1.2.9

Stax Addons for Elementor

Affected versions: *-1.4.3

Patched versions: 1.4.4

WP CTA – Call Now Button, Sticky Button & Call to Action Builder

Affected versions: *-1.5.8

Patched versions: 1.5.9

Gallery Box

Affected versions: *-1.7.30

Patched versions: 1.7.31

Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages

Affected versions: *-1.0.1

Patched versions: 1.0.2

Wiremo – Product Reviews for WooCommerce

Affected versions: *-1.4.96

Patched versions: 1.4.97

Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD

Affected versions: *-3.1.3

Patched versions: 3.1.4

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

Affected versions: 2.6.4

Patched versions: 2.6.5

Product Category Showcase for WooCommerce

Affected versions: *-1.1.9

Patched versions: 2.0.0

Researcher credit: István Márton

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
December 14, 2022
CVSS
4.3

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

Production Feed records are aggregated without claiming discovery, exploitation or infection. Applicable source notices remain attached to individual records. Read the methodology.