FunnelKit – Funnel Builder for WooCommerce Checkout

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   FunnelKit – Funnel Builder for WooCommerce Checkout

Information

Software Type Plugin
Software Slug funnel-builder (view on wordpress.org)
Software Status Active
Software Author amans2k
Software Website funnelkit.com
Software Downloads 824,664
Software Active Installs 30,000
Software Record Last Updated April 11, 2025

4 Vulnerabilities

Submit a Vulnerability
Funnel Builder by FunnelKit <= 3.9.0 - Unauthenticated Local File Inclusion
9.8
CVE-2025-26979
Feb 23, 2025
Researcher: Dimas Maulana
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update
4.3
CVE-2024-6836
Jul 23, 2024
Researcher: Lucio Sá
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
6.4
CVE-2024-5192
Jun 28, 2024
Researcher: wesley (wcraft)
Funnel Builder for WordPress by FunnelKit <= 2.14.3 - Authenticated(Administrator+) SQL Injection
6.6
CVE-2023-50856
Dec 21, 2023
Researcher: Muhammad Daffa
Title Status CVE ID CVSS Researchers Date
Funnel Builder by FunnelKit <= 3.9.0 - Unauthenticated Local File Inclusion Patched CVE-2025-26979 9.8 Dimas Maulana February 23, 2025
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update Patched CVE-2024-6836 4.3 Lucio Sá July 23, 2024
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload Patched CVE-2024-5192 6.4 wesley (wcraft) June 28, 2024
Funnel Builder for WordPress by FunnelKit <= 2.14.3 - Authenticated(Administrator+) SQL Injection Patched CVE-2023-50856 6.6 Muhammad Daffa December 21, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation

This site uses cookies in accordance with our Privacy Policy.