Stored Cross-Site Scripting Vulnerability in Popular WordPress Plugins by WordPress
CVE-2026-2568

7.2HIGH

Key Information:

Vendor

WordPress
Status
WP Zendesk For Contact Form 7, WPforms, Elementor, Formidable And Ninja Forms
Vendor
CVE Published:
3 March 2026

What is CVE-2026-2568?

The vulnerability in various WordPress plugins allows attackers to perform stored cross-site scripting (XSS) attacks through compromised form submission data. Affected plugins, including WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms, lack sufficient input sanitization and output escaping. As a result, unauthenticated attackers can inject malicious web scripts into the pages that execute when a user accesses them, potentially compromising user data and website integrity.

Affected Version(s)

WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms 0 <= 1.1.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3467904/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan
.