CVE-2025-10567

MediumCVSS 6.3/10Last modified Oct 19, 2026

Description

The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2025
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-105689.8HyperX NGENUITY software is potentially vulnerable to arbitrary code execution. HP is releasing updated software to address the potential vu CVE-2025-105696.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 tha CVE-2025-10574.3A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar f CVE-2025-105704.3The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and CVE-2025-105719.6Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: CVE-2025-105736.1Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript CVE-2025-105756.5The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryP CVE-2025-105768.5Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, whi CVE-2025-105778.5Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, whi CVE-2025-105787.8A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could CVE-2025-105795.3The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabili CVE-2025-10588.1CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is do