CVE-2026-2568

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2568", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-15T21:12:03.516Z", "datePublished": "2026-03-03T09:24:12.272Z", "dateUpdated": "2026-04-08T16:42:59.062Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:59.062Z"}, "affected": [{"vendor": "crmperks", "product": "WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27d26d1c-d027-4a22-af49-4d7684d36d40?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3467904/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2026-02-01T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-15T21:27:40.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-02T20:39:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T14:49:10.966964Z", "id": "CVE-2026-2568", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T14:49:20.869Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2568", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T14:49:10.966964Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T14:49:16.889Z"}}], "cna": {"title": "WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "crmperks", "product": "WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-01T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-15T21:27:40.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-02T20:39:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27d26d1c-d027-4a22-af49-4d7684d36d40?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3467904/"}], "descriptions": [{"lang": "en", "value": "The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:59.062Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2568", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:42:59.062Z", "dateReserved": "2026-02-15T21:12:03.516Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-03T09:24:12.272Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms", "vendor": "crmperks", "versions": [{"lessThanOrEqual": "1.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin WP Zendesk para Contact Form 7, WPForms, Elementor, Formidable y Ninja Forms para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de datos de env\u00edo de formularios en todas las versiones hasta la 1.1.5, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida deficiente. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-2568", "lastModified": "2026-06-17T10:31:20.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2568", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T14:49:10.966964Z", "version": "2.0.3"}}]}, "published": "2026-03-03T10:16:06.473", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3467904/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27d26d1c-d027-4a22-af49-4d7684d36d40?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms", "source": "cna", "vendor": "crmperks"}, "product": "wp_zendesk_for_contact_form_7,_wpforms,_elementor,_formidable_and_ninja_forms", "vendor": "crmperks"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:06:24.635241+00:00", "value": {"mitigation_remediation": ["Update the WP Zendesk plugin to the latest version (post\u20111.1.5) to remove the stored XSS vulnerability.", "Apply a web application firewall or similar security plugin to filter and block suspicious script payloads if an update cannot be performed immediately.", "Audit all stored form submissions for injected scripts and remove any malicious entries to prevent accidental execution while patching is underway."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress sites using the WP Zendesk plugin version 1.1.5 or older on the wp\u2011contact\u2011form\u20117, wpforms, elementor, formidable, and ninja forms integrations are affected. The vulnerability is tied to the plugin\u2019s processing of form submission data, regardless of site-specific customizations.", "description_and_impact": "The WP Zendesk plugin allows attackers without authentication to submit form data that is stored and later rendered without proper sanitization. This flaw enables injection of arbitrary web scripts into stored form entries, which execute whenever any user views the affected page, potentially compromising user browsers or facilitating credential theft.", "risk_and_exploitability": "The flaw carries a CVSS score of 7.2 and a very low EPSS probability of less than 1%, indicating it is currently not widely exploited. It is not listed in the CISA KEV catalog. Exploitation requires normal user interaction with a public form, but no privileged credentials are needed, making the attack vector purely unauthenticated via standard web traffic."}}}}, "created": "2026-03-04T14:54:27.671863+00:00", "updated": "2026-04-15T20:15:13.711860+00:00", "vendors": ["crmperks", "crmperks$PRODUCT$wp_zendesk_for_contact_form_7,_wpforms,_elementor,_formidable_and_ninja_forms", "wordpress", "wordpress$PRODUCT$wordpress"]}