CVE-2026-10734 describes a stored cross-site scripting vulnerability in the Infility Global WordPress plugin. The vulnerability exists in the /cf7_record log endpoint due to improper neutralization of input during web page generation (CWE-79). Attackers can inject arbitrary web scripts that execute in the context of any logged-in user who accesses the injected page, including users with Subscriber-level access. This occurs because the /cf7_records viewer is accessible to all authenticated users and the plugin fails to properly sanitize and escape input before rendering it.

Successful exploitation allows an attacker to execute arbitrary scripts in the browsers of authenticated users who visit the compromised page. This can lead to theft of user credentials, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /cf7_records viewer to trusted users only or disable the plugin if possible. Monitor vendor channels for updates and apply any official patches promptly once released.