Funnelforms Free Vulnerabilities

The Funnelforms Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t...

CVSS:

6.4

Affected:

up to 3.8

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62758 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Funnelforms Funnelforms Free allows DOM-Based XSS.This issue affects Funnelforms Free: from n/a through 3.8.

Affected:

up to 3.8

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62758 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.8

Fix:

No patched version reported

Disclosed:

Dec 25, 2025

CVE-2025-68582 on NVD →

[en] Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Funnelforms Free: from n/a through <= 3.8.

Affected:

up to 3.8

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68582 on NVD →

[en] The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-l...

Affected:

up to 3.7.5.1

Fix:

No patched version reported

Disclosed:

Dec 4, 2024

CVE-2024-10587 on NVD →

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level...

CVSS:

8.8

Affected:

up to 3.7.5.1

Fix:

No patched version reported

Disclosed:

Dec 3, 2024

CVE-2024-10587 on NVD →

[en] The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2_handel_file_remove AJAX action in all versions up to, and including, 3.7.3.2. This makes it possible for u...

Affected:

up to 3.7.4.1

Fixed in:

3.7.4.1

Disclosed:

Aug 29, 2024

CVE-2024-5857 on NVD →

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2_handel_file_remove AJAX action in all versions up to, and including, 3.7.3.2. This makes it possible for unauth...

CVSS:

5.3

Affected:

up to 3.7.3.2

Fixed in:

3.7.4.1

Disclosed:

Aug 28, 2024

CVE-2024-5857 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for unauthenticated attackers to d...

Affected:

up to 3.7.4.1

Fixed in:

3.7.4.1

Disclosed:

Aug 28, 2024

CVE-2024-6312 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary...

Affected:

up to 3.7.4.1

Fixed in:

3.7.4.1

Disclosed:

Aug 28, 2024

CVE-2024-6311 on NVD →

[en] The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it po...

Affected:

up to 3.7.4.1

Fixed in:

3.7.4.1

Disclosed:

Aug 28, 2024

CVE-2024-7447 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary file...

CVSS:

7.2

Affected:

up to 3.7.3.2

Fixed in:

3.7.4.1

Disclosed:

Aug 27, 2024

CVE-2024-6311 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for authenticated attackers, with admin...

CVSS:

6.5

Affected:

up to 3.7.3.2

Fixed in:

3.7.4.1

Disclosed:

Aug 27, 2024

CVE-2024-6312 on NVD →

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it possibl...

CVSS:

5.3

Affected:

up to 3.7.3.2

Fixed in:

3.7.4.1

Disclosed:

Aug 27, 2024

CVE-2024-7447 on NVD →

[en] The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Dec 4, 2023

CVE-2023-5990 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the F...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5417 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5411 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categ...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5416 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create copies of...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5385 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_copy_posts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts via a forged re...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5383 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_delete_posts function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request gr...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5382 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emai...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5419 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categor...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5415 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5387 on NVD →

[en] The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrar...

Affected:

up to 3.4.2

Fixed in:

3.4.2

Disclosed:

Nov 22, 2023

CVE-2023-5386 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary pos...

CVSS:

6.5

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5386 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_delete_posts function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted...

CVSS:

6.5

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5382 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnel...

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5417 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create copies of arbit...

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5385 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_copy_posts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts via a forged request...

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5383 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or d...

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5387 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categories...

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5416 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain post...

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5411 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories.

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5415 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to...

CVSS:

4.3

Affected:

up to 3.4

Fixed in:

3.4.2

Disclosed:

Nov 1, 2023

CVE-2023-5419 on NVD →

[en] The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Oct 16, 2023

CVE-2023-4950 on NVD →

Update the WordPress Funnelforms Free plugin to the latest available version (at least 3.4). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Funnelforms Free Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HT...

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Sep 19, 2023

The Funnelforms Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission answers in versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will e...

CVSS:

6.5

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Sep 18, 2023

CVE-2023-4950 on NVD →

The Funnelforms Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission answers in versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will e...

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Sep 18, 2023

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

3.2.9 – 3.3.8.4

Fixed in:

3.3.8.5

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.3.8.5

Fixed in:

3.3.8.5

CVE-2023-33999 on NVD →