WPFunnels — Vulnerabilities & Security Advisories 11

WPFunnels is a WordPress funnel builder plugin designed to create sales funnels and landing pages. Historically, it has been vulnerable to multiple security issues including remote code execution, cross-site scripting, and privilege escalation vulnerabilities. The plugin has accumulated 10 CVEs to date, with several critical flaws allowing attackers to execute arbitrary code or compromise site integrity. Notable characteristics include insufficient input validation and improper access controls in its form builder and funnel management features. Security researchers have consistently identified vulnerabilities in its shortcode processing and AJAX handlers, making it a recurring target for exploitation.