Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.4 - Missing Authorization
medium
The Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers...
- CVSS:
- 5.3
- Affected:
- up to 3.1.4
- Fixed in:
- 3.1.5
- Disclosed:
- Jun 4, 2026
CVE-2026-49110 on NVD →
Upsell Order Bump Offer for WooCommerce <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Upsell Order Bump Offer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitra...
- CVSS:
- 6.4
- Affected:
- up to 3.0.7
- Fixed in:
- 3.0.8
- Disclosed:
- Sep 22, 2025
CVE-2025-59565 on NVD →
Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation
medium
The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'add_offer_in_cart' function. This makes it possib...
- CVSS:
- 5.3
- Affected:
- up to 3.0.0
- Fixed in:
- 3.0.1
- Disclosed:
- Apr 24, 2025
CVE-2025-3743 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database