6.3
Moyenne
CVE-2025-10567 The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its…
Description
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| FunnelKit 3.12 | premières → < 3.12.0.1 | 3.12.0.1 |
Autres CVE de FunnelKit
Les 4 CVE de FunnelKit →
CVE-2026-12979
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a…
5.5
Moyenne
CVE-2026-12978
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into…
7.1
Élevée
CVE-2025-2203
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL…
6.1
Moyenne