CVE-2026-10734

Name of the Vulnerable Software and Affected Versions Infility Global versions prior to 2.15.22

Description Insufficient input sanitization and output escaping in the Infility Global plugin for WordPress allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs via the '/cf7 record' Log Endpoint, enabling the injection of arbitrary web scripts into pages. These scripts execute when any authenticated user, including those with Subscriber-level access, visits the '/cf7 records' viewer page.

Recommendations Update the plugin to a version newer than 2.15.21. Restrict access to the '/cf7 record' endpoint to prevent unauthenticated input until the update is applied.