Reflected XSS Vulnerability in FunnelKit WordPress Plugin
CVE-2025-10567
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-10567?
The FunnelKit WordPress plugin prior to version 3.12.0.1 is susceptible to a reflected XSS vulnerability. This issue arises because the plugin fails to properly sanitize user input in some of its checkout-related AJAX actions. As a result, authenticated users may be exposed to malicious scripts that can be injected into the web pages they interact with, potentially leading to unauthorized actions or sensitive data exposure.
Affected Version(s)
FunnelKit 0 < 3.12.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.