Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:funnelkit:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Funnelkit (1ccd9354-c95d-5ffd-99d2-c75b5626c6b8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12979 |
vulnerable | 2026-07-29 00:23:32.725144 |
FunnelKit < 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template Importer
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
Published: 2026-07-16T06:00:05.068Z
Updated: 2026-07-16T12:40:57.577Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12978 |
vulnerable | 2026-07-29 00:23:32.724824 |
FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.
Published: 2026-07-16T06:00:04.896Z
Updated: 2026-07-16T12:42:59.445Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2203 |
vulnerable | 2026-06-08 07:16:56.383510 |
WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Published: 2025-05-15T20:07:27.292Z
Updated: 2025-05-16T18:36:31.787Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10567 |
vulnerable | 2026-06-08 07:02:27.084476 |
FunnelKit < 3.12.0.1 - Reflected XSS
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
Published: 2025-11-05T06:00:02.503Z
Updated: 2025-11-05T18:45:38.517Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.