WPFunnels has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 4. The median CVSS is 7.1 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: creatorlms (3), wpfunnels (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- creatorlms 3
- wpfunnels 3
Worst active — by depth score
CVE-2026-62129Critical· 9.9Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.55CVE-2026-97244High· 7.5Contributor Path Traversal in Creator LMS <= 1.2.19 versions.41CVE-2026-97271High· 7.1Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.39CVE-2026-27371High· 7.1Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.39CVE-2026-97269Medium· 6.5Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.36
WPFunnels vulnerabilities
CVEs affecting WPFunnels, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-62129Critical· 9.9Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
CVE-2026-97269Medium· 6.5Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
CVE-2026-27371High· 7.1Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
CVE-2026-62083Medium· 5.4Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
CVE-2026-97244High· 7.5Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
CVE-2026-97271High· 7.1Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.