Vulnerability · Published Nov 5, 2025 · Assigned by WPScan
CVE-2025-10567FunnelKit < 3.12.0.1 - Reflected XSS
Medium 6.3
In plain English
A medium-severity security flaw in FunnelKit from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 91.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/c7536b0c-3bce-449d-937e-b0195990110a/ exploit, vdb-entry, technical-description