Getwpfunnels vulnerabilities
We track 5 vulnerabilities in Getwpfunnels products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 5, 2026.
Latest Getwpfunnels vulnerabilities
- 9.8 Critical severity
Mail Mint – Email Marketing, Newsletter, Email…: Deserialization of Untrusted Data
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' fu
- 8.8 High severity
WPFunnels – Funnel Builder for WooCommerce…: Improper Privilege Management
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST cal
- 9.8 Critical severity
WPFunnels – Funnel Builder for WooCommerce…: Unrestricted Upload of File with Dangerous Type
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of
- 8.8 High severity
Creator LMS – Online Courses and eLearning…: Missing Authorization
The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all ver
- 7.2 High severity
Mail Mint – Email Marketing, Newsletter, Email…: Unrestricted Upload of File with Dangerous Type
The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attribute_import function in all versions up to, and including, 1.18.10. This makes it possible for authenticated attackers, w