The vulnerability CVE-2025-26991 in ollybach WPPizza (<= 3.19.4) is a reflected cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted input, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects that the attack can be performed remotely over the network with low complexity, no privileges, but requires user interaction, and affects confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this reflected XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts by executing arbitrary scripts in the context of the victim's browser. This may allow attackers to steal session tokens, manipulate web content, or perform actions on behalf of the user. However, no known exploits are reported in the wild, and the impact is limited to users who interact with maliciously crafted input.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Additionally, limiting user interaction with untrusted input and employing web application firewalls may help mitigate risk. Monitor vendor channels for updates regarding patches or official fixes.