The plugin contains a Stored Cross‑Site Scripting vulnerability (CWE‑79) that allows authenticated users with Contributor level access or higher to inject arbitrary JavaScript into the default attribute of the wfop_phone shortcode. When a page containing that shortcode is viewed, the injected script executes in the victim's browser, providing attackers the ability to hijack sessions, deface content, or launch further attacks. This flaw does not impact unattended systems or users lacking Contributor rights, but any user who views the affected page can be compromised.

WordPress sites running the FunnelKit – Funnel Builder for WooCommerce Checkout plugin by amans2k, versions 3.13.1.2 and earlier. All installations of the plugin that include the wfop_phone shortcode are affected until the plugin is upgraded to a patched release.

The vulnerability has a CVSS score of 6.4 and an EPSS score of less than 1 %. It is not listed in CISA’s KEV catalog. Because it requires authenticated activity at the Contributor level or above, the exploitation likelihood is low on a site with strict role management, yet a compromised contributor can easily inject malicious content that will affect all users who view the page. Attackers could obtain access via phishing or exploiting other vulnerabilities to gain Contributor privileges before injecting the script.