WPFunnels vulnerabilities

Products

• WPFunnels 8
• Creator LMS 5
• Mail Mint 5
• WPFunnels Pro 1

Latest WPFunnels CVEs

Newest publication first

1. CVE-2026-62129 WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

   Published 2026-10-10

   Critical·CVSS 9.9 EPSS 0.26%

   Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

2. CVE-2026-97269 WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-10-01

   Medium·CVSS 6.5 EPSS 0.19%

   Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.

3. CVE-2026-97271 WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   High·CVSS 7.1 EPSS 0.14%

   Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

4. CVE-2026-97244 WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

   Published 2026-09-30

   High·CVSS 7.5 EPSS 0.29%

   Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

5. CVE-2026-62083 WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability

   Published 2026-09-30

   Medium·CVSS 5.4 EPSS 0.23%

   Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

6. CVE-2026-27371 WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

7. CVE-2026-84755 WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability

   Published 2026-09-03

   Medium·CVSS 6.5 EPSS 0.27%

   Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

8. CVE-2026-84754 WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability

   Published 2026-09-03

   Medium·CVSS 6.5 EPSS 0.33%

   Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

9. CVE-2026-84753 WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

   Published 2026-09-03

   Critical·CVSS 9.8 EPSS 0.56%

   Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

10. CVE-2026-49778 WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

    Published 2026-06-17

    High·CVSS 7.1 EPSS 0.19%

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

11. CVE-2026-32530 WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability

    Published 2026-03-25

    High·CVSS 8.8 EPSS 0.24%

    Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <= 1.1.18.

12. CVE-2026-23541 WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability

    Published 2026-02-19

    High·CVSS 7.5 EPSS 0.33%

    Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through <= 1.19.4.

13. CVE-2025-69359 WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability

    Published 2026-01-06

    Medium·CVSS 5.3 EPSS 0.27%

    Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.

14. CVE-2025-67571 WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

    Published 2025-12-09

    Medium·CVSS 5.3 EPSS 0.27%

    Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.

15. CVE-2025-59570 WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection Vulnerability

    Published 2025-09-22

    High·CVSS 7.6 EPSS 0.36%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.6.

16. CVE-2025-58604 WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection Vulnerability

    Published 2025-09-03

    High·CVSS 7.6 EPSS 0.36%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.

17. CVE-2025-54696 WordPress WPFunnels plugin <= 3.5.26 - Cross Site Scripting (XSS) vulnerability

    Published 2025-08-14

    Medium·CVSS 6.5 EPSS 0.24%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.

18. CVE-2025-47530 WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability

    Published 2025-05-23

    Critical·CVSS 9.8 EPSS 0.49%

    Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.

19. CVE-2024-27965 WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Published 2024-03-21

    Medium·CVSS 4.8 EPSS 0.34%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.