CVE-2026-2568 is a stored cross-site scripting vulnerability (CWE-79) in the WP Zendesk plugin for WordPress, affecting versions up to and including 1.1.5. The issue arises from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of form submission data. This flaw enables unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with a scope change.

Successful exploitation allows an unauthenticated attacker to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users visiting the affected pages. This can result in information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not impact availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to affected forms or disabling the plugin if feasible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.