https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-12469.htmlhttps://patchthecve.com/cve/CVE-2025-12469.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 4.3: The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrative ahttps://patchthecve.com/cve/CVE-2025-12468.htmlhttps://patchthecve.com/cve/CVE-2025-12468.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.3: The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a publichttps://patchthecve.com/cve/CVE-2025-1562.htmlhttps://patchthecve.com/cve/CVE-2025-1562.htmlWed, 17 Jun 2026 08:39:22 +0000CRITICAL 9.8: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in allhttps://patchthecve.com/cve/CVE-2025-2203.htmlhttps://patchthecve.com/cve/CVE-2025-2203.htmlWed, 17 Jun 2026 09:06:31 +0000MEDIUM 6.1: The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attackshttps://patchthecve.com/cve/CVE-2024-13675.htmlhttps://patchthecve.com/cve/CVE-2024-13675.htmlWed, 17 Jun 2026 07:02:30 +0000MEDIUM 6.4: The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Block in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenthttps://patchthecve.com/cve/CVE-2024-9186.htmlhttps://patchthecve.com/cve/CVE-2024-9186.htmlWed, 17 Jun 2026 08:24:06 +0000HIGH 8.6: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attackshttps://patchthecve.com/cve/CVE-2024-47328.htmlhttps://patchthecve.com/cve/CVE-2024-47328.htmlWed, 17 Jun 2026 07:56:53 +0000HIGH 7.6: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows SQL Injection.This issue affects FunnelKit Automations: from n/a through <= 3.1.2.https://patchthecve.com/cve/CVE-2024-1056.htmlhttps://patchthecve.com/cve/CVE-2024-1056.htmlWed, 17 Jun 2026 07:03:20 +0000MEDIUM 6.4: The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the 'wp_kses_allowed_html' filter to globally allow script and iframe tags in posts in all versions up to, and including, 3.4.5. This makes it poshttps://patchthecve.com/cve/CVE-2024-6836.htmlhttps://patchthecve.com/cve/CVE-2024-6836.htmlWed, 17 Jun 2026 08:18:48 +0000MEDIUM 4.3: The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and incluhttps://patchthecve.com/cve/CVE-2024-5192.htmlhttps://patchthecve.com/cve/CVE-2024-5192.htmlWed, 17 Jun 2026 08:15:22 +0000MEDIUM 6.4: The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ parameter in all versions up to, and including, 3.3.1 due to insufficient inpuhttps://patchthecve.com/cve/CVE-2023-51671.htmlhttps://patchthecve.com/cve/CVE-2023-51671.htmlWed, 17 Jun 2026 06:41:26 +0000MEDIUM 5.4: Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.https://patchthecve.com/cve/CVE-2023-51670.htmlhttps://patchthecve.com/cve/CVE-2023-51670.htmlWed, 17 Jun 2026 06:41:26 +0000MEDIUM 4.3: Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.