Unknown Funnelkit vulnerabilities

3 CVEs affecting Unknown Funnelkit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12979, published 2026-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12979, published 2026-07-16. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to…
CVE-2026-12978, published 2026-07-16. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated…
CVE-2025-10567, published 2025-11-05. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks…