PT-2026-4090 · Unknown · Infility Global

Published 2026-01-22 · Updated 2026-01-23 · CVE-2025-68864

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Infility Global versions through 2.14.50

Description The software contains a flaw due to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that malicious scripts can be stored on the target server and executed by users visiting the affected web pages. The vulnerability exists in Infility Global.

Recommendations Update Infility Global to a version later than 2.14.50.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-68864

Affected Products

Infility Global

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-68864 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/infility-global/vulnerability/wordpress-infility-global-plugin-2-14-49-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2014706996637835472 · Twitter Post