Is Cartflows safe?

Plugin details

• Slug: cartflows
• Requires PHP: 7.2+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.6.13 [CVE-2021-24330, WordPress Funnel Builder by CartFlows plugin <= 1.6.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability, Funnel Builder by CartFlows &lt; 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID, Funnel Builder by CartFlows <= 1.6.12 - Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.5.16 [WordPress Funnel Builder by CartFlows plugin <= 1.5.15 - Cross-Site Request Forgery (CSRF) vulnerability]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.5.16 [Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.3.1 [Funnel Builder by CartFlows &lt; 1.3.1 - Authenticated Arbitrary Plugin Activation]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.5.16 [Various Affected Software (Various Versions) - Cross-Site Request Forgery Bypass]

+ 9 more known vulnerabilities

• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.3.1 [Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.3.1 [CVE-2019-25151]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.5.16 [CVE-2021-4342]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.5.16 [CVE-2020-36736, WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass, WooCommerce Checkout &amp; Funnel Builder by CartFlows &lt; 1.5.16 - Cross-Site Request Forgery]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 1.11.12 [CartFlows <= 1.11.11 - Insecure Direct Object Reference to Arbitrary Post Deletion]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 2.0.2 [CVE-2024-29813, WordPress Funnel Builder by CartFlows Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS), Funnel Builder by CartFlows <= 2.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via settings, Funnel Builder by CartFlows &lt; 2.0.2 - Editor+ Stored XSS]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 2.0.8 [CVE-2024-4632, WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting, WordPress Funnel Builder by CartFlows Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 2.2.0 [CVE-2026-25316, CartFlows – Checkout & Funnel Builder for WooCommerce <= 2.1.19 - Authenticated (Administrator+) PHP Object Injection]
• CartFlows – Funnel Builder &amp; Checkout Plugin for WooCommerce [cartflows] < 2.2.4 [CVE-2026-39477, CartFlows <= 2.2.3 - Missing Authorization]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• Hostinger Reach – AI-Powered Email Marketing for WordPress — 1000000+ active installs — max PHP 8.4
• Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation — 30000+ active installs — max PHP <8.0
• Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content — 20000+ active installs — max PHP 8.4
• Icegram Engage – Popups, Optins, CTAs & Lead Generation — 10000+ active installs
• Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads — 10000+ active installs