WordPress FormLift for Infusionsoft Web Forms plugin up to version 7.5.20 contains an improper neutralization of user input when rendering web pages, resulting in a reflected XSS vulnerability. An attacker can supply malicious script in query parameters or form fields that is echoed back in the response, enabling arbitrary JavaScript execution in the victim’s browser. This could allow data theft, session hijacking, or phishing attacks against users who visit the affected pages.

Adrian Tobey’s FormLift for Infusionsoft Web Forms plugin for WordPress is affected. The vulnerability applies to all releases from the earliest available version up to and including 7.5.20.

CVSS score 7.1 ranks this issue as high severity. The EPSS score is below 1%, indicating a very low probability of widespread exploitation. It is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale attacks yet. The likely attack vector is via the publicly accessible web forms that the plugin generates, meaning any Internet‑connected WordPress site running the vulnerable plugin can be targeted without privileges.