6.3
Medium
CVE-2025-10567 The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its…
Description
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FunnelKit 3.12 | earliest → < 3.12.0.1 | 3.12.0.1 |
Other CVEs of FunnelKit
The 4 CVEs of FunnelKit →
CVE-2026-12979
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a…
5.5
Medium
CVE-2026-12978
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into…
7.1
High
CVE-2025-2203
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL…
6.1
Medium