GCVE - cpe:2.3:a:funnelforms:funnelforms:*:*:*:*:free:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:funnelforms:funnelforms:*:*:*:*:free:wordpress:*:*

part: a version: * update: *

Vendor	Funnelforms (`effb2001-247f-54cd-9460-66f9ecc077d7`)
Product	Funnelforms (`47e5408d-5863-583a-bcd7-b4f940bf3368`)
Edition	*
Language	*
Software edition	free
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-5419`	vulnerable	2026-06-08 06:19:43.557816	Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending MEDIUM (4.3) The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to an arbitrary email address. Published: 2023-11-22T15:33:25.228Z Updated: 2026-04-08T16:57:29.375Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/64248d15-e6a7-442f-b269-e9f629d297d3?source=cve https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5417`	vulnerable	2026-06-08 06:19:43.557512	Funnelforms Free <= 3.4 - Missing Authorization to Category Update MEDIUM (4.3) The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnelforms category for a given post ID. Published: 2023-11-22T15:33:20.139Z Updated: 2026-04-08T16:36:48.918Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/148794ea-3bc9-4084-bdb9-6ee63a781a39?source=cve https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5416`	vulnerable	2026-06-08 06:19:43.557057	Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion MEDIUM (4.3) The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categories. Published: 2023-11-22T15:33:32.162Z Updated: 2026-04-08T17:10:49.267Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/992fc98f-4b23-4596-81fb-5543d82fd615?source=cve https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5415`	vulnerable	2026-06-08 06:19:43.556547	Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation MEDIUM (4.3) The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories. Published: 2023-11-22T15:33:26.588Z Updated: 2026-04-08T16:59:46.644Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/6ec3051e-a5e4-48ee-8f8e-eb5dbc482f33?source=cve https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5411`	vulnerable	2026-06-08 06:19:43.550514	Funnelforms Free <= 3.4 - Missing Authorization to Post Modification MEDIUM (4.3) The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain post values. Note that the extent of modification is limited due to fixed values passed to the wp_update_post function. Published: 2023-11-22T15:33:30.215Z Updated: 2026-04-08T17:03:45.199Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/816f5fc1-e4e6-4c0d-b222-fe733f026e33?source=cve https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5387`	vulnerable	2026-06-08 06:19:43.494063	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5386`	vulnerable	2026-06-08 06:19:43.493758	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5385`	vulnerable	2026-06-08 06:19:43.493214	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5383`	vulnerable	2026-06-08 06:19:43.492181	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5382`	vulnerable	2026-06-08 06:19:43.491525	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.