This vulnerability, identified as CVE-2025-66067, affects the Aman Funnel Builder by FunnelKit up to version 3.13.1.2. It arises from improper neutralization of input during web page generation, leading to a DOM-based Cross-site Scripting (XSS) issue. The CVSS v3.1 base score is 6.5, indicating a medium severity level. The attack vector is network-based, with low attack complexity, requiring privileges and user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited disclosure of information, manipulation of web content, or disruption of application availability. The impact is rated medium due to the requirement of user interaction and limited privileges for the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying any available workarounds recommended by the vendor once published. Monitoring vendor channels for updates is advised.