The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 05 Nov 2025 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users. | |
| Title | FunnelKit < 3.12.0.1 - Reflected XSS | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2025-11-05T06:00:02.503Z
Reserved: 2025-09-16T15:06:48.980Z
Link: CVE-2025-10567
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-05T06:15:32.363
Modified: 2025-11-05T06:15:32.363
Link: CVE-2025-10567
Redhat
No data.
OpenCVE Enrichment
No data.