PT-2025-45080 · WordPress · Funnelkit

Marc Montpas · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-10567

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FunnelKit WordPress plugin versions prior to 3.12.0.1

Description The software does not properly sanitize user-provided data before displaying it in certain checkout-related AJAX operations. This can allow attackers to execute reflected cross-site scripting (XSS) attacks against users who are logged in. The issue involves echoing user input without sufficient validation, potentially leading to the injection of malicious scripts.

Recommendations Update to version 3.12.0.1 or later.

Exploit

Fix

Related Identifiers

CVE-2025-10567

Affected Products

Funnelkit

References · 4

• 🔥 https://wpscan.com/vulnerability/c7536b0c-3bce-449d-937e-b0195990110a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10567 · Security Note
• https://t.me/cveNotify/141763 · Telegram Post
• https://t.me/CVEtracker/36580 · Telegram Post