Vulnerabilities and security researches forinfility-global infility-global

Jan 08, 2025

CVE, Research URL: CVE-2024-11496
Home page URL: Security reports for Infility Global
Application: Infility Global
Date: Jan 07, 2025
Research Description: The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax function in all versions up to, and including, 2.9.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options and potentially break the site.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-12290
Home page URL: Security reports for Infility Global
Application: Infility Global
Date: Jan 07, 2025
Research Description: The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, and including, 2.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: Min -, max -.
Status: vulnerable

Jan 29, 2025

CVE, Research URL: CVE-2024-12723
Home page URL: Security reports for Infility Global
Application: Infility Global
Date: Jan 28, 2025
Research Description: The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Affected versions: Min -, max -.
Status: vulnerable

Jun 14, 2025

CVE, Research URL: CVE-2025-47651
Home page URL: Security reports for Infility Global
Application: Infility Global
Date: Jun 09, 2025
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global allows SQL Injection. This issue affects Infility Global: from n/a through 2.12.4.
Affected versions: Min -, max -.
Status: vulnerable