6.1
Medium
CVE-2025-2203 The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL…
Description
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FunnelKit 3.10 | earliest → < 3.10.2 | 3.10.2 |
Other CVEs of FunnelKit
The 4 CVEs of FunnelKit →
CVE-2026-12979
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a…
5.5
Medium
CVE-2026-12978
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into…
7.1
High
CVE-2025-10567
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its…
6.3
Medium