The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the `wfop_phone` shortcode's `default` attribute. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of user-supplied data. Authenticated attackers with Contributor-level privileges or higher can exploit this flaw to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This could lead to impacts such as session hijacking or unauthorized actions within the affected site. The vulnerability affects all plugin versions up to 3.13.1.2. The CVSS v3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject and store malicious scripts that execute in the browsers of users who view the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for plugin updates from the vendor that address this vulnerability and apply them promptly once released. Avoid using the vulnerable shortcode with untrusted input.