Medium severity6.3NVD Advisory· Published Nov 5, 2025· Updated Apr 15, 2026

CVE-2025-10567

Description

The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Funnelkit/FunnelKitllm-create
Range: <3.12.0.1
WordPress/FunnelKitwp-canonicalize

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c7536b0c-3bce-449d-937e-b0195990110a/nvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000