The WP Zendesk plugin allows attackers without authentication to submit form data that is stored and later rendered without proper sanitization. This flaw enables injection of arbitrary web scripts into stored form entries, which execute whenever any user views the affected page, potentially compromising user browsers or facilitating credential theft.

All WordPress sites using the WP Zendesk plugin version 1.1.5 or older on the wp‑contact‑form‑7, wpforms, elementor, formidable, and ninja forms integrations are affected. The vulnerability is tied to the plugin’s processing of form submission data, regardless of site-specific customizations.

The flaw carries a CVSS score of 7.2 and a very low EPSS probability of less than 1%, indicating it is currently not widely exploited. It is not listed in the CISA KEV catalog. Exploitation requires normal user interaction with a public form, but no privileged credentials are needed, making the attack vector purely unauthenticated via standard web traffic.