WordPress Surbma Infusionsoft Shortcode <= 2.0.1 Authenticated Stored XSS (CVE-2026-11597)

Vulnerability Overview Vulnerability Name: Surbma CVE ID: CVE-2026-11597 CVSS Score: 6.4 (Medium) Release Date: June 26, 2026 Last Updated: June 27, 2026 Researcher: zakaria Impact Scope Software Type: Plugin Software Name: surbma-infusionsoft-shortcode Affected Versions: <= 2.0.1 Fixed Version: 2.0.2 Remediation Recommendation: Update to version 2.0.2 or a higher patched version. Vulnerability Description This vulnerability arises from insufficient input sanitization and output escaping of user-supplied and shortcode attributes within the shortcode function, leading to a Stored Cross-Site Scripting (XSS) attack. An attacker can inject arbitrary scripts into a page, which are executed when a user visits the compromised page. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information API Documentation: API documentation Webhook Documentation: Webhook documentation Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Contact Information Contact Email: info@support@wordfence.com Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Email: Email Other Resources Learn More: Learn More Get Wordfence: Get Wordfence Documentation: Documentation Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: 24-hour support, 365 days a year, with a 1-hour response time. Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Icons X: X Facebook: Facebook Instagram: Instagram LinkedIn: LinkedIn Product Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Stay Updated: Sign up for news and updates from our panel of experienced security professionals. Email: email@example.com Terms of Service: By checking this box I agree to the terms of service and privacy policy. Sign Up: Sign Up Copyright Mark © 2012-2026 Defiant Inc. All Rights Reserved Other Marks Wordfence Intelligence Logo: Wordfence Intelligence Logo Other Links Have You Been Hacked?: Have You Been Hacked? Get Help: Get Help Create Account: Create Account Sign In: Sign In View Pricing: View Pricing Additional Information Wordfence Intelligence: Wordfence Intelligence Vulnerability Database: Vulnerability Database Surbma Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org Other Links plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.trac.wordpress.org: plugins.trac.wordpress.org plugins.tra

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Surbma Infusionsoft Shortcode <= 2.0.1 Authenticated Stored XSS (CVE-2026-11597)