Brainstormforce Cartflows – Funnel Builder & Checkout Plugin For Woocommerce vulnerabilities

3 vulnerabilities

Known vulnerabilities in Brainstormforce Cartflows – Funnel Builder & Checkout Plugin For Woocommerce, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2020-36736brainstormforcecartflows – funnel builder & checkout plugin for woocommerce+2
EPSS score
0.46%
The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15. This is due to missing or incorrect nonce validation on the export_json, import_json, and status_logs_file functions. This makes it possible for unauthenticated attackers to import/export settings and trigger logs showing via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.6.4CVE-2024-4632brainstormforcecartflows – funnel builder & checkout plugin for woocommerce+1
EPSS score
0.39%
The WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.5.4CVE-2019-25151brainstormforcecartflows – funnel builder & checkout plugin for woocommerce+2
EPSS score
0.71%
The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.