CVE-2025-26992 describes a reflected cross-site scripting vulnerability in the Landing Page Cat plugin by fatcatapps affecting versions up to 1.7.8. The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that execute when a victim loads a crafted URL. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or disruption of service. The impact is rated as high severity due to the combination of network attack vector and scope change, though confidentiality, integrity, and availability impacts are limited to low levels.

No official patch or remediation guidance is currently available from the vendor or authoritative sources. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and avoid clicking on suspicious links that may exploit this vulnerability.