CVE-2026-8163

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above...

EUVD-2025-206786

The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infilitygetdata' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2024-12723

The Infility Global WordPress plugin (versions 2.9.8 and earlier ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape a parameter before it is output back to the page. This vulnerability could be exploited against high-privi...