Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Infility Component: Infility Global Clear all filters
TI-2024-11796 CVE-2024-12723 · GHSA-mcv5-jrjw-4vgm

Infility Global <= 2.9.8 - Reflected XSS

Priority MEDIUM 60

The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege us…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00286 Published 2025-01-28 No fix listed CWE-79
TI-2024-10647 CVE-2024-11496 · GHSA-j59p-hrrw-r2fq

Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update

Priority LOW 29

The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax function in all versions up to, and including, 2.9.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00341 Published 2025-01-07 No fix listed CWE-862
TI-2024-11400 CVE-2024-12290 · GHSA-4rq5-fqvj-3w68

Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter

Priority LOW 27

The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, and including, 2.9.8 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00378 Published 2025-01-07 No fix listed CWE-79