The Infility Global plugin for WordPress contains a stored cross-site scripting vulnerability that could allow attackers to execute malicious scripts in the context of an administrator's session.

This is a stored cross-site scripting (CWE-79) vulnerability occurring within the /cf7_record log endpoint. It allows unauthenticated attackers to inject malicious scripts that are stored and executed when a user views the log data.

Successful exploitation could lead to session hijacking, defacement, or the execution of unauthorized administrative actions. Given the CVSS score of 7.2, this vulnerability poses a significant threat to the security of the WordPress administrative dashboard and overall site integrity.

Immediate Action: As no patch is currently available, administrators should immediately deactivate and remove the Infility Global plugin until a secure version is released.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unauthorized changes to site configuration that might indicate an XSS-based attack.

Compensating Controls: Implement a robust Content Security Policy (CSP) and use a Web Application Firewall (WAF) to filter malicious input patterns targeting the /cf7_record endpoint.

Public Exploit Available: Unknown

This vulnerability is critical due to the lack of a vendor-provided fix. Users must prioritize removing the affected software to prevent exploitation until the developer releases a patched version.