CVE-2026-2568

Name of the Vulnerable Software and Affected Versions WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress versions up to and including 1.1.5

Description The plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping when handling form submission data. This allows unauthenticated attackers to inject malicious web scripts into pages. When a user accesses a page containing the injected script, the script will execute.

Recommendations Update the WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress to a version later than 1.1.5.