CVE-2026-11597 – Surbma | Infusionsoft Shortcode

CVE ID :CVE-2026-11597

Published : June 27, 2026, 6:50 a.m. | 54 minutes ago

Description :The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘infusionsoft-form’ shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied ‘account’ and ‘id’ shortcode attributes in the surbma_infusionsoft_shortcode_shortcode() function, which are concatenated directly into a