CVE-2025-66067
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Funnel Builder by FunnelKit plugin through version 3.13.1.2 contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. Malicious code executes in the user's browser.
Risk Assessment
An attacker can execute a malicious script in the user's browser, hijacking the session or performing actions on their behalf. This affects confidentiality and integrity.
Recommendation
Update the Funnel Builder plugin to a version later than 3.13.1.2. Deploy input validation and a WAF.
Other vulnerabilities in Funnel Builder by FunnelKit
See all- CVE-2026-42381Critical
There is an unauthenticated SQL injection vulnerability in Funnel Builder by FunnelKit versions up to 3.15.0.1.
- CVE-2026-57816High
The Funnel Builder plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into HTTP request parameters, which will be executed in the victim's browser.
- CVE-2026-48966High
Versions of Funnel Builder by FunnelKit up to 3.15.0.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows DOM-Based XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.13.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS