VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Nov 5, 2025· Updated Jun 17, 2026

CVE-2025-10567

CVE-2025-10567

Description

The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • WordPress/FunnelKitwp-canonicalize2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: <3.12.0.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.