PatchTheCVEfunnel builder vulnerabilities and fixes
Recent CVEs affecting funnel builder, with upgrade or downgrade steps. 4 tracked.
Also searched as: funnelbuilder.
funnel builder has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-05-15. Highest priority: CVE-2025-2203 (score 31/100).
- CVE-2025-2203 MEDIUM 6.1 UPGRADE The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQ
- CVE-2024-6836 MEDIUM 4.3 UPGRADE The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Or
- CVE-2024-5192 MEDIUM 6.4 UPGRADE The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Or
- CVE-2024-1056 MEDIUM 6.4 UPGRADE The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'al
FAQ
How do I fix funnel builder vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is funnel builder being exploited right now?
None of the tracked funnel builder CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which funnel builder CVE should I patch first?
CVE-2025-2203 currently ranks highest (31/100): The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQ.