CVE-2025-26989 describes a stored cross-site scripting vulnerability in softdiscover's Zigaform plugin (zigaform-form-builder-lite) versions up to 7.4.2. The issue is caused by improper neutralization of input during web page generation, which allows malicious script injection that persists and executes in users' browsers. This vulnerability can be exploited remotely without privileges and requires user interaction. The CVSS 3.1 score of 7.1 reflects its high severity, with impacts on confidentiality, integrity, and availability. No patch or official remediation details are currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability allows an attacker to execute stored malicious scripts in the context of affected users' browsers. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The attack requires no privileges but does require user interaction. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider limiting exposure by restricting access to the vulnerable plugin or disabling it if feasible.