PT-2025-47436 · WordPress · Funnelkit – Funnel Builder For Woocommerce Checkout

Djaidja Moundjid

·

Published

2025-11-19

·

Updated

2025-11-19

·

CVE-2025-12878

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress versions up to and including 3.13.1.2
Description The software is susceptible to Stored Cross-Site Scripting through the wfop phone shortcode. This is a result of inadequate input sanitization and output escaping of the default attribute provided by the user. Authenticated attackers with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute each time a user accesses the compromised page.
Recommendations Update FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress to a version later than 3.13.1.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-12878

Affected Products

Funnelkit – Funnel Builder For Woocommerce Checkout