Funnelforms vulnerabilities
Published CVEs affecting Funnelforms products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-39440
Critical · 9.9
CWE-94 Apr 23, 2026
Funnelforms FunnelFormsPro Code Injection Leading to Remote Code Inclusion (CVE-2026-39440)
Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1.
CVE-2025-62758
Medium · 6.5
CWE-79 Dec 31, 2025
WordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Funnelforms Funnelforms Free funnelforms-free allows DOM-Based XSS.This issue affects Funnelforms Free: from n/a through <= 3.8.
CVE-2025-68582
Medium · 5.3
CWE-862 Dec 24, 2025
WordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Funnelforms Free: from n/a through <= 3.8.