Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free

Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 16 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2023 was the busiest year with 12 disclosures.

The most common weakness is Missing Authorization, behind 11 of the records (58%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

16 of the records (84%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2024.

9 independent researchers contributed these findings, most of them (8) reported by Alex Thomas.

Strategic Overview

Avg CVSSMedium

5.5/ 10

Patch Coverage84%

Open

Fixed

Get automatic notifications for all Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2024-10587

Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection

Read the full analysis

Vulnerability Records

19 records


2025-12-31 00:00	Funnelforms Free <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Interactive Contact Form and Multi… <= 3.8	`CVE-2025-62758`	6.4 Medium	Muhammad Yudha - DJ	No
2025-12-25 00:00	Funnelforms Free <= 3.8 - Missing Authorization Interactive Contact Form and Multi… <= 3.8	`CVE-2025-68582`	5.3 Medium	Legion Hunter	No
2024-12-03 14:17	Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection Interactive Contact Form and Multi… <= 3.7.5.1	`CVE-2024-10587`	8.8 High	Peter Thaleikis	No
2024-08-28 00:00	Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion Interactive Contact Form and Multi… <= 3.7.3.2	`CVE-2024-5857`	5.3 Medium	Lucio Sá	Yes
2024-08-27 00:00	Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload Interactive Contact Form and Multi… <= 3.7.3.2	`CVE-2024-7447`	5.3 Medium	Lucio Sá	Yes
2024-08-27 00:00	Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload Interactive Contact Form and Multi… <= 3.7.3.2	`CVE-2024-6311`	7.2 High	István Márton	Yes
2024-08-27 00:00	Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion Interactive Contact Form and Multi… <= 3.7.3.2	`CVE-2024-6312`	6.5 Medium	István Márton	Yes
2023-11-01 00:00	Funnelforms Free <= 3.4 - Missing Authorization to Category Update Interactive Contact Form and Multi… <= 3.4	`CVE-2023-5417`	4.3 Medium	Alex Thomas	Yes
2023-11-01 00:00	Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion Interactive Contact Form and Multi… <= 3.4	`CVE-2023-5386`	6.5 Medium	Alex Thomas	Yes
2023-11-01 00:00	Funnelforms Free <= 3.4 - Missing Authorization to Post Modification Interactive Contact Form and Multi… <= 3.4	`CVE-2023-5411`	4.3 Medium	Alex Thomas	Yes

Showing 1–10 of 19 reports