CVE-2026-2568
Received Received - Intake

Stored XSS in WP Zendesk Plugin for WordPress Forms

Publication date: 2026-03-03

Last updated on: 2026-03-03

Assigner: Wordfence

Description
The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-03
Last Modified
2026-03-03
Generated
2026-07-06
AI Q&A
2026-03-03
EPSS Evaluated
2026-07-05
NVD
CVE-2026-2568
EUVD
EUVD-2026-9284

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
wp_zendesk contact_form_7_zendesk to 1.1.5 (inc)
wp_zendesk contact_form_7_zendesk 1.1.6
wpforms wpforms *
elementor elementor *
formidable formidable *
ninja_forms ninja_forms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-2568 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Zendesk plugin for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms for WordPress. This vulnerability exists in all versions up to and including 1.1.5 due to insufficient input sanitization and output escaping.

It allows unauthenticated attackers to inject arbitrary web scripts into pages via form submission data. These scripts execute whenever a user accesses the injected page, potentially compromising user data or site integrity.

Impact Analysis

This vulnerability can impact you by allowing attackers to execute malicious scripts in the context of your website without authentication. This can lead to theft of user credentials, session hijacking, defacement of your website, or distribution of malware to your users.

Because the vulnerability is a Stored XSS, the malicious code persists on the site and affects every user who visits the compromised page.

The CVSS v3.1 base score of 7.2 indicates a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed, making it a serious risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the vulnerability in the WP Zendesk for Contact Form 7 plugin, you should immediately update the plugin to version 1.1.6 or later, as this version includes fixes for the security issues including the Stored Cross-Site Scripting and PHP Object Injection vulnerabilities.

Ensure that your WordPress installation is running version 3.8 or higher and PHP version 5.3 or higher, as these are the minimum requirements for the fixed plugin version.

Review and apply any additional security best practices such as sanitizing and validating input data, especially in form submissions, and monitor your site for any suspicious activity related to form inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart