Surbma | Infusionsoft Shortcode

Surbma | Infusionsoft Shortcode has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Surbma | Infusionsoft Shortcode has a vendor fix available, so running the current release closes it.

All of these findings were reported by zakaria. Surbma | Infusionsoft Shortcode is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Surbma | Infusionsoft Shortcode vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-11597

Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Read the full analysis

Vulnerability Records

1 records


2026-06-26 17:50	Surbma \| Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Surbma <= 2.0.1	`CVE-2026-11597`	6.4 Medium	zakaria	Yes

Showing 1–1 of 1 reports

Latestv2.0.2

Surbma | Infusionsoft Shortcode

Author

Surbma

0.0(0)

0/100

Last Updated

2026-06-22 (2mo ago)

Active Installs

10+

Downloads

2,037

Requires WP

5.1+

Requires PHP

7.0+

Tested up to

WP 7.0.4

Created

2014-11-30 (12y ago)

A simple shortcode to include Infusionsoft forms into WordPress. The shortcode: [infusionsoft-form account="" id=""] Where account is your choosen subdomain name without the .infusionsoft.com part and the id is the Infusionsoft form id, that you want to display.

View on WordPress.org