Getwpfunnels
Vulnerability activity for Getwpfunnels: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.5MediumOct 16, 2026Getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance SQL injectionCVE-2026-111106The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do
- 5.3MediumSep 9, 2026Getwpfunnels WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell Auth bypass / access controlCVE-2026-84908The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id.
- 4.9MediumSep 9, 2026Getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails SQL injectionCVE-2026-19800The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The $wpdb->prepare() call does not protect against this injection because the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string
- 9.8CriticalSep 5, 2026Getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails DeserializationCVE-2026-10196The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.
Top products
- Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails2 CVEs in the last year, 1 critical
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell1 CVE in the last year
- Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.