Executive brief
The Surbma | Infusionsoft Shortcode plugin for WordPress, which allows users to easily embed Infusionsoft forms into their websites, contains a security flaw. This vulnerability allows an attacker with basic contributor-level access to inject malicious scripts into website pages. When other users or administrators visit these pages, the scripts will execute, potentially leading to unauthorized actions or the theft of sensitive information.
Technical details
The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the surbma_infusionsoft_shortcode_shortcode() function. Specifically, the 'account' and 'id' attributes of the 'infusionsoft-form' shortcode are concatenated directly into a <script> tag's src attribute without proper validation. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute in the context of any user's browser who visits the affected page. The issue is present in versions up to and including 2.0.1.
Affected products
- Surbma Surbma | Infusionsoft Shortcode up to, and including, 2.0.1
Timeline
- 2026-06-27: disclosed
- 2026-06-27: advisory
References
- https://plugins.trac.wordpress.org/browser/surbma-infusionsoft-shortcode/tags/2.0/surbma-infusionsoft-shortcode.php
- https://plugins.trac.wordpress.org/browser/surbma-infusionsoft-shortcode/tags/2.0/surbma-infusionsoft-shortcode.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3581906%40surbma-infusionsoft-shortcode&new=3581906%40surbma-infusionsoft-shortcode&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3581936%40surbma-infusionsoft-shortcode&new=3581936%40surbma-infusionsoft-shortcode&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a91fe9-f642-4a61-a175-ed5bb537bf08?source=cve