CVE-2025-12878: FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfopphone shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied default attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12878?
CVE-2025-12878 has a high severity rating due to its potential for Stored Cross-Site Scripting.
How do I fix CVE-2025-12878?
To fix CVE-2025-12878, update the FunnelKit – Funnel Builder for WooCommerce Checkout plugin to version 3.13.1.3 or later.
Which versions are affected by CVE-2025-12878?
CVE-2025-12878 affects all versions of the FunnelKit – Funnel Builder for WooCommerce Checkout plugin up to and including 3.13.1.2.
What kind of attack can CVE-2025-12878 facilitate?
CVE-2025-12878 can facilitate Stored Cross-Site Scripting attacks due to insufficient input sanitization.
Is user data at risk with CVE-2025-12878?
Yes, user data may be at risk as attackers could exploit CVE-2025-12878 to execute malicious scripts in the context of the affected site.