CVE-2026-11597 describes a stored cross-site scripting vulnerability in the Surbma | Infusionsoft Shortcode WordPress plugin (up to version 2.0.1). The vulnerability arises from insufficient input sanitization and output escaping of the 'account' and 'id' shortcode attributes within the surbma_infusionsoft_shortcode_shortcode() function. These attributes are concatenated directly into a <script> tag's src attribute, enabling authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the vulnerable shortcode attributes. This can lead to the execution of arbitrary JavaScript in the browsers of users who visit the affected pages, potentially resulting in data theft, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires authenticated access, limiting its scope somewhat but still posing a significant risk to site users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Surbma | Infusionsoft Shortcode plugin if possible. Monitor for updates from the vendor regarding an official patch or workaround.