WPFunnels — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in WPFunnels, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-62029	WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability CWE-79	6.5	Medium	2026-10-09
CVE-2026-97269	WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability CWE-639	6.5	Medium	2026-10-01
CVE-2026-97271	WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability CWE-79	7.1	High	2026-09-30
CVE-2026-27371	WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79	7.1	High	2026-09-30
CVE-2026-79631	WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files	-	-	2026-09-04
CVE-2026-79632	WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission	-	-	2026-09-04
CVE-2026-79630	WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution	-	-	2026-09-04
CVE-2025-15691	WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms	-	-	2026-09-04
CVE-2026-84754	WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability CWE-862	6.5	Medium	2026-09-03
CVE-2025-67571	WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability CWE-862	5.3	Medium	2025-12-09
CVE-2025-54696	WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability CWE-79	6.5	Medium	2025-08-14
CVE-2025-47530	WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability CWE-502	9.8	Critical	2025-05-23
CVE-2024-27965	WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability CWE-79	5.9	Medium	2024-03-21

All 13 known CVE vulnerabilities affecting WPFunnels with full Chinese analysis, references, and POCs where available.