WordPress plugin · funnel-builder
Is FunnelKit safe?
Safe on 3.17.0.1 or newer.
The current version, 3.17.0.1, is past every affected range on record (19 of 21 records list one; 2 don’t, so check those below). Keep it updated and you’re clear of them.
- Flaws on record
- 21
- High or critical
- 14
- Exploited
- none
- Current version
- 3.17.0.1
- Last updated
- Oct 21, 2026
- Active installs
- 30,000+
Every recorded flaw
- Oct 16, 2026FunnelKit – Funnel Builder for WooCommerce Checkout: Authorization bypassCVE-2026-107746 · affects up to 3.16.0.6 · reported by WordfenceHigh 7.5
- Oct 10, 2026FunnelKit – Funnel Builder for WooCommerce Checkout: Stored Cross-Site ScriptingCVE-2026-100147 · affects up to 3.16.0.5 · reported by WordfenceHigh 7.2
- Jul 16, 2026FunnelKit: Does not validate a user-supplied path before deleting a file during a template-import operationCVE-2026-12979 · fixed in 3.15.0.6 · reported by WPScanMedium 5.5
- Jul 16, 2026FunnelKit: Does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actionsCVE-2026-12978 · fixed in 3.15.0.6 · reported by WPScanHigh 7.1
- Jul 13, 2026Funnel Builder by FunnelKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57816 · affects up to 3.15.0.8 · reported by PatchstackHigh 7.1
- Jun 24, 2026Funnel Builder by FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-56052 · affects up to 3.15.0.5 · reported by PatchstackHigh 7.6
- Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.CVE-2026-48966 · affects up to 3.15.0.2 · reported by PatchstackHigh 7.1
- Jun 15, 2026Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.CVE-2026-42381 · affects up to 3.15.0.1 · reported by PatchstackCritical 9.3
- May 19, 2026the public checkout endpoint that: Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorizationCVE-2026-47100 · reported by VulnCheckHigh 8.7
- Dec 12, 2025FunnelKit - Funnel Builder for WooCommerce Checkout: Time-based blind SQL InjectionCVE-2025-14169 · affects up to 3.13.1.5 · reported by WordfenceHigh 7.5
- Nov 21, 2025Funnel Builder by FunnelKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66067 · affects up to 3.13.1.2 · reported by PatchstackMedium 6.5
- Nov 19, 2025FunnelKit – Funnel Builder for WooCommerce Checkout: Stored Cross-Site ScriptingCVE-2025-12878 · affects up to 3.13.1.2 · reported by WordfenceMedium 6.4
- Nov 5, 2025FunnelKit: Does not sanitize user input before echoing it back in some of its checkout-related AJAX actionsCVE-2025-10567 · fixed in 3.12.0.1 · reported by WPScanMedium 6.3
- Aug 20, 2025Funnel Builder by FunnelKit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-54750 · affects up to 3.11.1 · reported by PatchstackHigh 7.5
- Aug 19, 2025Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode.CVE-2025-7654 · reported by WordfenceHigh 8.8
- Jul 16, 2025Funnel Builder by FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49034 · affects up to 3.10.2 · reported by PatchstackHigh 7.6
- May 15, 2025FunnelKit: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2203 · fixed in 3.10.2 · reported by WPScanMedium 6.1
- Feb 25, 2025Funnel Builder by FunnelKit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26979 · affects up to 3.9.0 · reported by PatchstackHigh 7.5
- Jul 24, 2024The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPressCVE-2024-6836 · affects up to 3.4.6 · reported by WordfenceMedium 4.3
- Jun 29, 2024The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPressCVE-2024-5192 · affects up to 3.3.1 · reported by WordfenceMedium 6.4
- Dec 28, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – CustCVE-2023-50856 · affects up to 2.14.3 · reported by PatchstackHigh 7.6
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.