Vendor
The Infility Global WordPress plugin is vulnerable to Stored XSS via the /cf7_record endpoint, allowing unauthenticated attackers to execute arbitrary scripts in the context of authenticated users.