Log in Start free

getwpfunnels

Products

ProductCVEsExploitedLatest
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell8–Sep 9, 2026
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails7–Sep 9, 2026
Creator LMS – Online Courses and eLearning Plugin1–Jan 20, 2026
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance1–Oct 16, 2026

Exploited and recent CVEs

  • CVE-2026-111106 Medium 6.5 Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter 0.3%
  • CVE-2026-84908 Medium 5.3 WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action 0.4%
  • CVE-2026-19800 Medium 4.9 Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter 0.5%
  • CVE-2026-10196 Critical 9.8 Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields 1.1%
  • CVE-2026-15103 High 8.8 WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter 0.6%
  • CVE-2026-12918 Medium 4.9 Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter 0.5%
  • CVE-2026-14342 Medium 4.9 Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter 0.4%
  • CVE-2026-13080 Medium 6.6 WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter 1.2%
  • CVE-2026-14345 Critical 9.8 WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter 1.4%
  • CVE-2026-0626 Medium 6.4 WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode 0.2%
  • CVE-2026-1258 Medium 4.9 Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints 0.4%
  • CVE-2026-1447 Medium 5.4 Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting 0.2%
  • CVE-2025-15347 High 8.8 Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update 0.3%
  • CVE-2025-11967 High 7.2 Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload 0.6%
  • CVE-2025-12000 Medium 6.5 WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal 0.8%
  • CVE-2025-12353 Medium 5.3 WPFunnels <= 3.6.2 - Unauthorized User Registration 0.2%
  • CVE-2024-10792 Medium 6.1 Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting 0.6%