Plugin icon

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce

cartflows

Vulnerabilities:

8

Last Updated:

June 2, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2026-03-27
Title
CartFlows < 2.2.4 - Missing Authorization
Fixed in
Fixed in 2.2.4
CVSS
4.3 (medium)
Published
2026-01-26
Title
CartFlows – Checkout & Funnel Builder for WooCommerce < 2.2.0 - Authenticated (Administrator+) PHP Object Injection
Fixed in
Fixed in 2.2.0
CVSS
6.6 (medium)
Published
2024-06-18
Title
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce < 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.8
CVSS
6.4 (medium)
Published
2024-03-25
Title
Funnel Builder by CartFlows < 2.0.2 - Editor+ Stored XSS
Fixed in
Fixed in 2.0.2
CVSS
3.5 (low)
Published
2021-05-17
Title
Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID
Fixed in
Fixed in 1.6.13
CVSS
5.5 (medium)
Published
2020-09-26
Title
WooCommerce Checkout & Funnel Builder by CartFlows < 1.5.16 - Cross-Site Request Forgery
Fixed in
Fixed in 1.5.16
CVSS
4.3 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 1.5.16
CVSS
5.4 (medium)
Published
2019-11-07
Title
Funnel Builder by CartFlows < 1.3.1 - Authenticated Arbitrary Plugin Activation
Fixed in
Fixed in 1.3.1
CVSS
n/a