CVE-2026-10734 describes a stored cross-site scripting vulnerability in the Infility Global plugin for WordPress. The flaw exists in the /cf7_record log endpoint, where input is not properly sanitized or escaped before being rendered. This allows unauthenticated attackers to inject arbitrary JavaScript payloads that execute in the context of any authenticated user who accesses the affected records page. The vulnerability affects all versions up to and including 2.15.21. The CVSS 3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope change.

Successful exploitation allows an unauthenticated attacker to inject persistent malicious scripts that execute in the browsers of any authenticated user visiting the affected page. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the logged-in user. Since even Subscriber-level users are affected, the impact extends to a broad range of authenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the /cf7_records viewer to trusted users only and consider disabling the plugin if possible. Monitor vendor channels for updates and apply any official fixes promptly once released.