CVE-2025-12878 Overview
CVE-2025-12878 is a Stored Cross-Site Scripting (XSS) vulnerability in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress. The flaw affects all versions up to and including 3.13.1.2. It resides in the wfop_phone shortcode, which fails to properly sanitize input and escape output on the user-supplied default attribute. Authenticated users with Contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who loads the affected page. The vulnerability is tracked under CWE-79.
Critical Impact
Authenticated Contributor-level attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, admin account takeover, and content manipulation.
Affected Products
- FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress
- All versions up to and including 3.13.1.2
- Fixed in version 3.13.1.3
Discovery Timeline
- 2025-11-19 - CVE-2025-12878 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12878
Vulnerability Analysis
The FunnelKit Funnel Builder plugin implements a set of merge-tag shortcodes for opt-in and contact fields. The wfop_phone shortcode accepts a default attribute intended to pre-populate the phone field with a value. The shortcode handler renders this attribute back into page output without sufficient sanitization or escaping. As a result, HTML and JavaScript payloads placed in the attribute survive the render path and are emitted inline in the resulting DOM.
Because the payload persists in post or page content, the XSS is stored rather than reflected. Every visitor loading the affected page triggers execution in their browser context. Payloads can steal authentication cookies, hijack sessions, perform actions as an administrator through the WordPress REST API, or inject additional malicious content. The relevant handler code is available in the plugin source at class-bwf-optin-tags.php.
Root Cause
The root cause is missing input sanitization and missing output escaping on the default shortcode attribute. WordPress provides functions such as sanitize_text_field() for input filtering and esc_attr() or esc_html() for context-aware output escaping. Neither was applied to this attribute in the vulnerable handler, allowing raw markup to reach the rendered page.
Attack Vector
An attacker requires an authenticated account with Contributor privileges or higher on the target WordPress site. The attacker inserts the wfop_phone shortcode with a crafted default attribute containing script markup into a post or page. Once the content is viewed by another user, the payload executes in that user's session. Because the shortcode renders on the front end, both anonymous visitors and logged-in administrators are exposed. Review the vendor fix in WordPress ChangeSet 3397106 for the corrected escaping logic.
Detection Methods for CVE-2025-12878
Indicators of Compromise
- Post or page content containing wfop_phone shortcode instances with default attribute values that include <script>, onerror=, onload=, or javascript: payloads.
- New or modified WordPress administrator accounts created shortly after Contributor-level content edits.
- Unexpected outbound HTTP requests from browsers rendering plugin-powered checkout or opt-in pages.
- WordPress wp_posts rows edited by Contributor accounts that reference FunnelKit merge tags.
Detection Strategies
- Query the WordPress database for shortcode patterns such as [wfop_phone combined with HTML angle brackets or on[a-z]+= handlers inside attributes.
- Compare the installed plugin version against 3.13.1.3 and flag any host running 3.13.1.2 or earlier.
- Deploy a web application firewall rule that inspects saved post content for script content inside shortcode attributes.
Monitoring Recommendations
- Enable WordPress audit logging to record post edits, user role changes, and shortcode modifications by Contributor accounts.
- Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that host FunnelKit shortcodes.
- Alert on administrative REST API calls originating from browser sessions that recently loaded pages containing the wfop_phone shortcode.
How to Mitigate CVE-2025-12878
Immediate Actions Required
- Update the FunnelKit – Funnel Builder for WooCommerce Checkout plugin to version 3.13.1.3 or later on all WordPress sites.
- Audit posts, pages, and templates for existing wfop_phone shortcode usage and remove any attribute values containing HTML or script markup.
- Review Contributor, Author, and Editor accounts, and rotate credentials for any account that shows suspicious content edits.
- Force password resets for administrators who may have viewed compromised pages before patching.
Patch Information
The vendor released a fix in version 3.13.1.3 of the plugin. The corrected code adds proper escaping to the default attribute in the merge-tag handler. Details are available in the Wordfence Vulnerability Report and the WordPress plugin page.
Workarounds
- Restrict Contributor and higher-level roles to trusted users only until the patch is applied.
- Temporarily disable the FunnelKit Funnel Builder plugin on sites where upgrading immediately is not feasible.
- Deploy a web application firewall with an XSS ruleset that blocks script content submitted through shortcode attributes.
- Enforce a strict Content Security Policy that disallows inline script execution on front-end pages.
# Configuration example: update the plugin using WP-CLI
wp plugin update funnel-builder --version=3.13.1.3
wp plugin list --name=funnel-builder --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
