Wpfunnels
CVE-2024-27965
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.
AnalysisAI
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.0.6. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.0.6. Affected products include: Getwpfunnels Wpfunnels.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all ve
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visi
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured or
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remot
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthentic
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers t
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remot
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today