The vulnerability is an improper neutralization of input during web page generation (CWE-79) that allows attackers to store malicious JavaScript in the Infility Global WordPress plugin. Because the plugin fails to escape user-supplied data, arbitrary scripts can run in the browsers of authenticated or unauthenticated visitors, potentially leading to data theft, session hijacking, defacement or further compromise of the site.

The affected product is the Infility Global plugin for WordPress. Versions from the initial release up to and including 2.15.11 are vulnerable. Any WordPress installation that has the plugin set to an affected version is at risk.

The CVSS score of 7.1 indicates a high damage potential for a successful exploit. The EPSS score of less than 1% suggests that, at the time of this analysis, the likelihood of a public exploit being used is low, and the vulnerability is not listed in the CISA KEV. Based on the description, it is inferred that attackers could exploit this flaw by inserting crafted payloads through any input field that the plugin stores, such as comment sections or contact forms. If the payload is executed in the browser of a site visitor, the attacker can hijack that visitor’s session or exfiltrate sensitive data.