Funnelforms vulnerabilities
We track 3 vulnerabilities in Funnelforms products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 23, 2026.
Latest Funnelforms vulnerabilities
- 9.9 Critical severity
FunnelFormsPro: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1.
- 8.8 High severity
Interactive Contact Form and Multi Step Form…: Deserialization of Untrusted Data
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it p
- 7.2 High severity
Interactive Contact Form and Multi Step Form…: Unrestricted Upload of File with Dangerous Type
The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with adminis