CVE-2026-2568

High

Published: 03 March 2026

Published

03 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0015 35.0th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2568 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-2568 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress. It affects all versions up to and including 1.1.5. The issue arises from insufficient input sanitization and output escaping of form submission data, enabling the injection of arbitrary web scripts into pages.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity, no privileges, and no user interaction required, as indicated by its CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). By submitting malicious scripts via supported forms, attackers can store them on the site; these scripts then execute in the browsers of any users who access the affected pages, potentially enabling theft of sensitive data, session hijacking, or site defacement.

Mitigation details are available in the WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset/3467904/, which addresses the vulnerability. Further analysis appears in the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/27d26d1c-d027-4a22-af49-4d7684d36d40?source=cve. Security practitioners should ensure sites update the plugin to a version beyond 1.1.5.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9284

Vulnerability details

The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and…

output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1056.001 Keylogging Collection

Adversaries may log user keystrokes to intercept credentials as the user types them.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

T1491.001 Internal Defacement Impact

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

attack.mitre.org →

Why these techniques?

Stored XSS in public-facing WordPress forms directly enables T1190 (exploiting the unauthenticated form endpoint). Payload execution in victim browsers facilitates T1056.001 (keylogging/input theft), T1539 (cookie theft), T1185 (session hijacking), and T1491.001 (page defacement).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1