Infility vulnerabilities

We track 8 vulnerabilities in Infility products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on August 16, 2026.

8vulnerabilities

1critical

7high

0exploited

7.8average CVSS score

Latest Infility vulnerabilities

7.2 High severity
Infility Global: Improper Neutralization of Input During Web Page Generation
CVE-2026-10734Aug 16, 2026Infility
The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthentica
7.5 High severity
Infility Global: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-15268Feb 4, 2026Infility
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of suffic
7.1 High severity
Infility Global: Improper Neutralization of Input During Web Page Generation
CVE-2025-68864Jan 22, 2026Infility
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Stored XSS.This issue affects Infility Global: from n/a through <= 2.15.11.
9.3 Critical severity
Infility Global: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-68865Jan 5, 2026Infility
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.
8.8 High severity
Infility Global: Unrestricted Upload of File with Dangerous Type
CVE-2025-12968Dec 12, 2025Infility
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the `upload_file` function in the `infility_import_file` cl
7.1 High severity
Infility Global: Improper Neutralization of Input During Web Page Generation
CVE-2025-47652Jul 16, 2025Infility
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.13.4.
7.1 High severity
Infility Global: Improper Neutralization of Input During Web Page Generation
CVE-2025-52774Jun 27, 2025Infility
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.15.06.
8.5 High severity
Infility Global: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-47651Jun 9, 2025Infility
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.