CVE-2025-12878: 
WordPress vulnerability analysis and mitigation

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-12878) discovered on November 18, 2025. The vulnerability affects all versions up to and including 3.13.1.2 and is related to insufficient input sanitization and output escaping in the wfop_phone shortcode's default attribute (NVD, Rapid7).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue specifically involves the wfop_phone shortcode where the user-supplied default attribute lacks proper input sanitization and output escaping mechanisms (Wordfence).

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever users access the compromised pages, potentially leading to data theft, session hijacking, or other malicious actions (NVD).

The vulnerability has been patched in version 3.13.1.3 of the FunnelKit plugin. Users are advised to update to this version or later to protect against potential exploitation. The update includes enhanced plugin security for optin personalized shortcodes (WordPress Plugin).