An unauthenticated stored cross-site scripting vulnerability in the WP Zendesk plugin allows remote attackers to inject malicious scripts into WordPress pages, posing a significant risk to site integrity.

This is a stored cross-site scripting (XSS) vulnerability occurring when form submission data is not properly sanitized or escaped. Unauthenticated attackers can inject arbitrary scripts that execute within the browser of any user who accesses the compromised page.

The vulnerability carries a CVSS score of 7.2, reflecting a high risk due to the lack of required authentication and the potential for wide-scale impact. Successful exploitation can lead to unauthorized actions performed on behalf of administrators, session hijacking, or the redirection of site visitors to malicious content, potentially resulting in reputational damage and loss of user trust.

Immediate Action: Update the WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin to the latest version, which includes the necessary security patches.

Proactive Monitoring: Audit WordPress administrative logs for suspicious form submissions or unexpected script tags appearing in saved content.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common XSS patterns in form input fields until the plugin can be successfully updated.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation, it is imperative that administrators verify their plugin version immediately. If you are running version 1.1.5 or lower, apply the vendor-supplied update without delay to eliminate the risk of arbitrary script execution. If an update is not immediately feasible, consider disabling the plugin until a secure version can be deployed.