Skip to content
Noroxi

Infility Global

infility-global · plugin

Known security vulnerabilities for Infility Global. Find out in seconds which version runs on your site with WP Lens.

12 known vulnerabilities

1 critical · 7 exploitable without logging in · latest Aug 16, 2026

Listed on wordpress.org · latest 2.16.10 · last updated Sep 21, 2026 · 100+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-68865unauthenticated≤ 2.15.06

    WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability

    Critical 9.3

  • CVE-2025-12968subscriber+≤ 2.14.42

    Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload

    High 8.8

  • CVE-2025-47651login required≤ 2.15.06

    WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability

    High 8.5

  • CVE-2025-15268unauthenticated≤ 2.14.46

    Infility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass

    High 7.5

  • CVE-2026-10734unauthenticated≤ 2.15.21

    Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint

    High 7.2

  • CVE-2025-68864unauthenticated · needs a click≤ 2.15.11

    WordPress Infility Global plugin <= 2.15.11 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-47652unauthenticated · needs a click≤ 2.13.4

    WordPress Infility Global plugin <= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-52774unauthenticated · needs a click≤ 2.15.06

    WordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-8685subscriber+≤ 2.15.16

    Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter

    Medium 6.5

  • CVE-2025-47650login required≤ 2.15.06

    WordPress Infility Global <= 2.15.06 - Arbitrary File Download vulnerability

    Medium 6.5

  • CVE-2024-11496subscriber+≤ 2.9.8

    Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update

    Medium 6.5

  • CVE-2024-12290unauthenticated · needs a click≤ 2.9.8

    Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter

    Medium 6.1

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory