Read the docs

Infility

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Infility records in CISA KEV

No Infility vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Infility Global 3 records MEDIUM

Records

3 records in Infility Global · all components

TI-2024-11796 CVE-2024-12723 · GHSA-mcv5-jrjw-4vgm

Infility Global <= 2.9.8 - Reflected XSS

Priority MEDIUM 60

The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege us…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00286 Published 2025-01-28 No fix listed CWE-79
TI-2024-10647 CVE-2024-11496 · GHSA-j59p-hrrw-r2fq

Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update

Priority LOW 29

The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax function in all versions up to, and including, 2.9.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00341 Published 2025-01-07 No fix listed CWE-862
TI-2024-11400 CVE-2024-12290 · GHSA-4rq5-fqvj-3w68

Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter

Priority LOW 27

The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, and including, 2.9.8 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00378 Published 2025-01-07 No fix listed CWE-79
Open these records in search →