Stored Cross-Site Scripting Vulnerability in Popular WordPress Plugins by WordPress

CVE-2026-2568

What is CVE-2026-2568?

The vulnerability in various WordPress plugins allows attackers to perform stored cross-site scripting (XSS) attacks through compromised form submission data. Affected plugins, including WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms, lack sufficient input sanitization and output escaping. As a result, unauthenticated attackers can inject malicious web scripts into the pages that execute when a user accesses them, potentially compromising user data and website integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References