BaseFortify

Publication date: 2025-11-05

Last updated on: 2025-11-06

Assigner: WPScan

Description

The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-05

Last Modified

2025-11-06

Generated

2026-07-06

AI Q&A

2025-11-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-10567

EUVD

EUVD-2025-37812

Affected Vendors & Products

Vendor	Product	Version / Range
funnelkit	funnelkit	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the FunnelKit WordPress plugin versions before 3.12.0.1. It occurs because the plugin does not sanitize user input before echoing it back in some of its checkout-related AJAX actions. This allows attackers to perform reflected Cross-Site Scripting (XSS) attacks against logged-in users.

Impact Analysis

The vulnerability can allow attackers to execute malicious scripts in the context of logged-in users on a website using the vulnerable FunnelKit plugin. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the user.

Hi! I’m here to help you understand CVE-2025-10567. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70