WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell, with AI-generated Chinese analysis, references, and POCs.

Vendor: getwpfunnels

CVE ID	Title	CVSS	Severity	Published
CVE-2026-84908	WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action CWE-862	5.3	Medium	2026-09-09
CVE-2026-15103	WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter CWE-269	8.8	High	2026-07-16
CVE-2026-13080	WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter CWE-98	6.6	Medium	2026-07-09
CVE-2026-14345	WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter CWE-434	9.8	Critical	2026-07-07
CVE-2026-0626	WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode CWE-79	6.4	Medium	2026-04-04
CVE-2025-12000	WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal CWE-22	6.5	Medium	2025-11-08
CVE-2025-12353	WPFunnels <= 3.6.2 - Unauthorized User Registration CWE-639	5.3	Medium	2025-11-08
CVE-2024-10792	Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting CWE-79	6.1	Medium	2024-11-21

All 8 known CVE vulnerabilities affecting WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell with full Chinese analysis, references, and POCs where available.