The vulnerability identified as CVE-2025-26542 affects Zalo Live Chat versions up to 1.1.0 and is categorized as a reflected cross-site scripting (XSS) flaw. It results from improper input neutralization during web page generation, enabling attackers to inject and execute arbitrary scripts in users' browsers. This can lead to partial compromise of confidentiality, integrity, and availability of affected systems. The CVSS vector indicates the attack can be performed remotely with low complexity, requires no privileges but user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity with partial impact on these security properties. However, there are no known exploits in the wild at present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users of Zalo Live Chat should monitor for vendor updates addressing this vulnerability. Until a fix is available, consider applying input validation or output encoding workarounds if feasible, and limit exposure by restricting access to the affected component where possible.