EUVD-2026-59921
GHSA-fp78-cpf3-8fqx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Injection is unauthenticated over the network (AV:N/PR:N), but payload execution requires a victim to visit the records page (UI:R); scope changes into authenticated user browser context (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The /cf7_records viewer is accessible to any authenticated user including those with Subscriber-level access, meaning the injected payload executes for any logged-in user who visits the records page.
AnalysisAI
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required to inject the payload - the /cf7_record log endpoint accepts unauthenticated POST requests from any network-accessible client, and no non-default configuration is needed to expose this endpoint on a standard Infility Global installation through version 2.15.21. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 score is driven primarily by the changed-scope vector component (S:C), which accurately captures that an unauthenticated attacker's payload crosses into the security context of authenticated user sessions - a meaningful escalation beyond server-side impact alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a crafted HTTP POST request to the publicly accessible /cf7_record log endpoint containing a JavaScript payload embedded in a log field - for example, a script that exfiltrates document.cookie to an attacker-controlled server. The payload is stored in the plugin's records database without sanitization. … |
| Remediation | Upgrade the Infility Global WordPress plugin to a version beyond 2.15.21 once a patched release is published by the vendor - no specific fixed version number was confirmed in the available intelligence at time of analysis, and patch status should be verified directly via the WordPress.org plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0de639a9-37a6-4a72-8afb-ff43de81a83c?source=cve. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress installations running Infility Global plugin version 2.15.21 or earlier, disable or remove the plugin immediately, and audit server logs for suspicious POST requests to the /cf7_record endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infility Global
View allSQL injection in the Infility Global WordPress plugin before 2.15.19 allows authenticated users with Subscriber-level ac
Time-based blind SQL injection in the Infility Global WordPress plugin (versions before 2.15.20) enables authenticated a
SQL Injection in the Infility Global WordPress plugin (all versions through 2.15.16) allows authenticated attackers hold
The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today