CVE-2025-6588

MEDIUM

2025-07-24 [email protected]

WordPress XSS

6.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Jul 24, 2025 - 10:15 nvd

MEDIUM 6.1

DescriptionNVD

The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.

AnalysisAI

Reflected cross-site scripting (XSS) in the FunnelCockpit WordPress plugin up to version 1.4.3 allows unauthenticated attackers to inject arbitrary JavaScript through the 'error' parameter due to insufficient input sanitization and output escaping. Exploitation requires social engineering an administrative user to click a malicious link, enabling attackers to steal session cookies, perform administrative actions, or redirect users to phishing sites. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

FunnelCockpit is a WordPress plugin that implements funnel and marketing automation features within the WordPress admin interface. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS flaw in the admin class file at line 433 where the 'error' parameter is processed without proper input sanitization (via functions like sanitize_text_field() or wp_kses()) or output escaping (via functions like esc_attr() or esc_html()). The affected parameter flows directly from user input to the HTML response, allowing malicious script injection. WordPress plugins at this layer operate with administrative context and full database access, making successful XSS exploitation particularly severe.

Affected ProductsAI

FunnelCockpit WordPress plugin versions up to and including 1.4.3 (CPE identifier would be cpe:2.4:a:funnelcockpit:funnelcockpit:*:*:*:*:*:wordpress:*:* with version constraint <=1.4.3). The vulnerability affects all installations of this plugin deployed on WordPress sites running the affected versions.

RemediationAI

Update the FunnelCockpit plugin to a patched version released after 1.4.3. Per the WordPress plugin repository changeset reference (3337752), a fix has been committed to the plugin repository. Site administrators should navigate to Plugins > Installed Plugins in the WordPress admin dashboard, locate FunnelCockpit, and click 'Update Now' to retrieve the patched version. If an automatic update is not available, manually download the latest version from the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/funnelcockpit/trunk/ or via the official plugin page. For users unable to update immediately, restrict access to WordPress admin pages using HTTP authentication, IP whitelisting, or a Web Application Firewall (WAF) rule to block requests containing suspicious script payloads in the 'error' parameter.

CVE-2025-6588 vulnerability details – vuln.today

Back