Unknown Wpfunnels vulnerabilities

4 CVEs affecting Unknown Wpfunnels, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-79632, published 2026-09-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-79631, published 2026-09-04. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to…
CVE-2026-79632, published 2026-09-04. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the…
CVE-2026-79630, published 2026-09-04. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated…
CVE-2025-15691, published 2026-09-04. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the…