CVE-2026-11597

Name of the Vulnerable Software and Affected Versions Surbma | Infusionsoft Shortcode versions prior to 2.0.2

Description Stored Cross-Site Scripting occurs via the 'infusionsoft-form' shortcode. The issue stems from insufficient input sanitization and output escaping within the surbma infusionsoft shortcode shortcode() function. Specifically, the account and id shortcode attributes are concatenated directly into a <script> tag's src attribute. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update Surbma | Infusionsoft Shortcode to version 2.0.2 or later. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the 'infusionsoft-form' shortcode.