CVE-2026-10734 in Global Plugin
Summary
by MITRE • 08/16/2026
The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The /cf7_records viewer is accessible to any authenticated user including those with Subscriber-level access, meaning the injected payload executes for any logged-in user who visits the records page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
The Infility Global plugin for WordPress contains a critical security vulnerability identified as Stored Cross-Site Scripting within its /cf7_record Log Endpoint. This flaw exists in all versions up to and including 2.15.21, stemming from insufficient input sanitization and output escaping mechanisms during the processing of user-supplied data. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that are subsequently rendered for other users. When a victim accesses an affected page containing the injected payload, the malicious script executes within their browser context, potentially leading to session hijacking, credential theft, or defacement depending on the attacker's objectives and the privileges of the targeted user account.
The operational impact is significantly amplified by the access control configuration associated with this endpoint. The /cf7_records viewer interface is accessible to any authenticated WordPress user, including those holding only Subscriber-level permissions. This low barrier to entry means that even users with minimal administrative rights can trigger or view the stored payloads if they have previously interacted with forms processed by the plugin. Consequently, an attacker does not need high-privilege access to exploit this vulnerability; instead, they can inject malicious content through standard form submissions, which then affects any other logged-in user who visits the records page. This broadens the attack surface considerably compared to vulnerabilities restricted to administrative users only.
From a technical classification perspective, this issue aligns with CWE-79, known as Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-site Scripting. The specific nature of storing malicious scripts in server-side storage for later retrieval and execution categorizes it under Stored XSS rather than reflected or DOM-based variants. In terms of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection via Browser Hijacking and potentially Credential Access if session cookies are stolen. Attackers can leverage these capabilities to maintain persistence within a WordPress environment by exfiltrating sensitive data from authenticated sessions without needing direct database access initially.
Mitigation strategies should prioritize immediate remediation through software updates. Administrators must upgrade the Infility Global plugin to version 2.15.22 or later, where developers have addressed the input sanitization and output escaping deficiencies responsible for this flaw. Until an update is applied, temporary mitigations may include restricting access to the /cf7_records endpoint via web application firewall rules if possible, although such measures are less effective against stored payloads already embedded in database records. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of successful XSS attacks by limiting script execution sources and preventing unauthorized data exfiltration. Regular security audits and code reviews focusing on input validation practices for all user-facing endpoints are recommended to prevent similar vulnerabilities in future releases or other plugins within the same ecosystem.