CVE-2025-12878

Vulnerability

Overview

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress versions up to and including 3.13.1.2 is vulnerable to Stored Cross-Site Scripting (XSS). The flaw resides in the wfop_phone shortcode, where the default attribute is not properly sanitized or escaped when rendered on a page. This allows malicious HTML or JavaScript to be stored and executed in the context of a user's browser session [1].

Attack

Surface

An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts by supplying a crafted default value in the shortcode. No additional privileges are required beyond the Contributor role, which is commonly granted to lower-level content authors. The injected script will execute for any user who views the affected page, including administrators and store visitors [1].

Impact

Successful exploitation enables the attacker to perform a range of malicious actions, such as stealing session cookies, redirecting users to phishing sites, or modifying page content. Because the attack is stored, the payload persists until the shortcode is manually removed or the plugin is updated.

Mitigation

The vendor has addressed this vulnerability in version 3.13.1.3 and later. Users are strongly advised to update to the latest version immediately. No workarounds have been published, but disabling the shortcode or restricting Contributor permissions could reduce risk in the interim.