Description

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The /cf7_records viewer is accessible to any authenticated user including those with Subscriber-level access, meaning the injected payload executes for any logged-in user who visits the records page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-16T07:16:30.043Z",
  "pubdate": "2026-08-16T07:16:30.043Z",
  "executiveSummary": "The Infility Global plugin for WordPress in all versions up to, and including, 2.15.21 is vulnerable to Stored Cross-Site Scripting (XSS). This security flaw arises from insufficient input sanitization and output escaping mechanisms within the /cf7_record log endpoint. Unauthenticated attackers can leverage this vulnerability to inject arbitrary web scripts into the logging system. Consequently, whenever a user accesses the injected page, the malicious payload executes within their browser context.\nThe impact of this vulnerability is significant, as the /cf7_records viewer is accessible to any authenticated user, including low-privileged accounts such as those with Subscriber-level access. This broadens the attack surface, allowing the stored payload to execute for any logged-in user who visits the records page. Risk implications include potential session hijacking, unauthorized actions performed on behalf of authenticated users, and further compromise of the WordPress application depending on the targeted user's privileges. Exploitation requires no prior authentication to inject the payload, although viewing and triggering the execution relies on accessing the vulnerable records viewer interface.",
  "technicalDetails": "The vulnerability resides in the Infility Global plugin for WordPress, specifically affecting all versions up to, and including, 2.15.21. The root cause of the security issue is the lack of proper input sanitization and output escaping for data processed and stored via the /cf7_record log endpoint. When untrusted data is submitted to this endpoint, the application fails to neutralize executable content, allowing malicious scripts to be permanently stored within the database or log storage mechanism.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious payload containing arbitrary web scripts (such as JavaScript) designed to execute within a victim's browser. Second, the attacker sends this payload to the vulnerable /cf7_record log endpoint without requiring any authentication credentials. Third, the application accepts the input and stores it within the logging mechanism without adequate sanitization. Fourth, an authenticated user with access to the /cf7_records viewer—such as a user with Subscriber-level access—navigates to the records page. Finally, when the application renders the stored log data, the missing output escaping causes the browser to parse and execute the embedded script.\nThe affected component is the logging and record-viewing functionality associated with the /cf7_record log endpoint and the /cf7_records viewer interface. Network exposure is present via the HTTP/HTTPS interface exposed by the WordPress installation. Because unauthenticated actors can reach the log endpoint to store the payload, and low-privileged users (Subscribers) can access the viewer interface, the attack vector bypasses standard perimeter defenses for script injection. The post-exploitation impact includes the execution of arbitrary JavaScript within the session of any logged-in user who views the compromised records page, potentially leading to unauthorized data access, session compromise, or administrative action tampering if a higher-privileged user visits the endpoint."
}