CVE-2025-26556 describes a reflected cross-site scripting vulnerability in the WP AntiDDOS plugin by zzmaster. The issue is due to improper input neutralization during web page generation, which can allow attackers to execute arbitrary scripts in the context of the victim's browser. This affects all versions up to 2.0 of the plugin. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity, requires no privileges but requires user interaction, and impacts confidentiality, integrity, and availability to a low extent. No patch or vendor advisory is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The reflected XSS nature means the attack requires user interaction, such as clicking a crafted link. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or replacing the WP AntiDDOS plugin to mitigate risk. Additionally, applying web application firewall (WAF) rules that detect and block reflected XSS payloads may help reduce exposure.