https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-12723.htmlhttps://patchthecve.com/cve/CVE-2024-12723.htmlWed, 17 Jun 2026 07:00:20 +0000MEDIUM 6.1: The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.https://patchthecve.com/cve/CVE-2024-12290.htmlhttps://patchthecve.com/cve/CVE-2024-12290.htmlWed, 17 Jun 2026 06:59:26 +0000MEDIUM 6.1: The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, and including, 2.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web shttps://patchthecve.com/cve/CVE-2024-11496.htmlhttps://patchthecve.com/cve/CVE-2024-11496.htmlWed, 17 Jun 2026 06:57:50 +0000MEDIUM 6.5: The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax function in all versions up to, and including, 2.9.8. This makes it possible for authenticated attackers, with Subscriber-level access and above,