Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied 'account' and 'id' shortcode attributes in the surbma_infusionsoft_shortcode_shortcode() function, which are concatenated directly into a <script> tag's src attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-11597 The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and inc… https://www.cve.org/CVERecord?id=CVE-2026-11597
Post summary
The passage announces a stored XSS flaw in the Infusionsoft Shortcode WordPress plugin, detailing the vulnerable feature and affected versions.
CVE-2026-11597 Stored Cross-Site Scripting in Surbma Infusionsoft Shortcode Plugin Up to 2.0.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11597
Post summary
A stored XSS vulnerability (CVE‑2026‑11597) is disclosed for the Surbma Infusionsoft Shortcode Plugin up to version 2.0.1, with a link to vulnerability details, but no PoC, exploit, patch, or active exploitation information is provided.