WordPress funnelforms-free has 15 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-6312 | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af | medium | 6.5 | <=3.7.3.2 | – |
| CVE-2024-6311 | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' | high | 7.2 | <=3.7.3.2 | – |
| CVE-2023-5386 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 6.5 | <=3.4 | – |
| CVE-2024-7447 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | <3.7.4.1 | 3.7.4.1 |
| CVE-2023-5387 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | <=3.4 | – |
| CVE-2023-5415 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | <=3.4 | – |
| CVE-2023-5416 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_d | medium | 4.3 | <=3.4 | – |
| CVE-2023-5385 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_c | medium | 4.3 | <=3.4 | – |
| CVE-2023-5411 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | <=3.4 | – |
| CVE-2023-5417 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_u | medium | 4.3 | <=3.4 | – |
| CVE-2023-5419 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_a | medium | 4.3 | <=3.4 | – |
| CVE-2024-5857 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | <3.7.4.1 | 3.7.4.1 |
| CVE-2023-5382 | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 6.5 | <=3.4 | – |
| CVE-2023-5990 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on | medium | 6.5 | <3.4.2 | 3.4.2 |
| CVE-2023-5383 | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to | medium | 4.3 | <=3.4 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked