The Infility Global plugin for WordPress is vulnerable to reflected cross‑site scripting because it fails to properly neutralize user‑supplied input before rendering it in a web page. An attacker can inject malicious JavaScript that is immediately reflected back to the victim when a specially crafted URL or form is accessed. This flaw can lead to theft of session cookies, authentication bypass, and other malicious client‑side actions, compromising confidentiality and integrity of data accessed through the affected site.

WordPress sites that have the Infility Global plugin installed with versions n/a through <= 2.13.4. The vulnerability is specific to this plugin and does not affect other plugins or core WordPress files.

The CVSS score of 7.1 places the flaw in the medium‑to‑high severity range, and the EPSS score of less than 1% indicates that real‑world exploitation is currently rare. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it via a crafted request that includes malicious input in URL parameters or form fields; no special privileges or network access are required beyond being able to visit the affected site. While exploitation probability is low, the potential impact on credentials and session data warrants prompt attention.