Stored Cross-Site Scripting in Infility Global WordPress Plugin

The Infility Global plugin for WordPress (versions 2.15.21 and earlier) contains a vulnerability due to insufficient input sanitization and output escaping. Specifically, the /cf7_record log endpoint allows unauthenticated attackers to inject malicious web scripts into the application's logging database. Because the /cf7_records viewer page is accessible to any authenticated user, including those with minimal Subscriber-level privileges, these injected scripts execute in the browser of any user who accesses the records interface. This flaw poses a significant risk to organizational WordPress instances by facilitating session hijacking, administrative account takeover, or the distribution of malicious redirects through legitimate site content.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated user's session. This can lead to the theft of session cookies, modification of site content, or the execution of unauthorized administrative actions, effectively compromising the WordPress site and the integrity of data handled within the admin interface.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update the Infility Global plugin for WordPress to version 2.15.22 or later to resolve CVE-2026-10734.
• Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /cf7_record endpoint containing script tags or common JavaScript event handlers (e.g., <script>, onerror, onload).
• Audit logs for the /cf7_record endpoint to identify any suspicious HTTP POST requests containing payload strings that deviate from the expected logging schema.
• Apply the Sigma rule below to identify potential exploitation attempts in web server access logs.