The vulnerability CVE-2025-26544 affects the Max K UTM tags tracking plugin for Contact Form 7 (versions up to 2.1). It is a reflected Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts through UTM tags, potentially impacting confidentiality, integrity, and availability of affected systems. The CVSS score is 7.1 (high severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial impacts on confidentiality, integrity, and availability. No patch or remediation information is currently available.

Successful exploitation can lead to reflected XSS attacks, which may allow attackers to execute arbitrary scripts in the context of the affected web application. This can result in partial loss of confidentiality, integrity, and availability. The vulnerability requires user interaction and affects the scope beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting use of the vulnerable plugin to mitigate risk. Monitor for updates from the vendor or trusted security sources.