Reflected Cross-Site Scripting in FunnelCockpit Plugin for WordPress

CVE-2025-6588

What is CVE-2025-6588?

The FunnelCockpit plugin for WordPress contains a vulnerability that allows reflected cross-site scripting via the 'error' parameter. Versions prior to 1.4.2 lack proper input sanitization and output escaping, enabling unauthenticated attackers to inject malicious scripts into web pages. These scripts can execute if an administrative user is deceived into clicking a malicious link, posing significant security risks to user data and website integrity.

References