FormLift for Infusionsoft Web Forms Security & Risk Analysis

The "formlift" plugin v7.5.21 presents a mixed security profile. While it demonstrates some positive security practices, such as a good percentage of properly escaped outputs and a decent number of nonce checks, significant concerns remain. The presence of 3 unprotected AJAX handlers is a notable weakness, creating direct entry points for potential attackers. Additionally, the taint analysis revealing 7 flows with unsanitized paths, though not resulting in critical or high severity vulnerabilities in this static scan, indicates a potential for issues if exploited. The plugin's history of 3 known CVEs, including a past critical SQL injection vulnerability, is a significant red flag. Although there are no currently unpatched vulnerabilities, the recurring types of vulnerabilities (XSS and SQL Injection) suggest persistent coding flaws that attackers might still be able to leverage. The recent vulnerability in June 2025 is particularly concerning, suggesting that even recent versions may have exploitable weaknesses.