The vulnerability CVE-2025-26994 in softdiscover's Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin is a stored cross-site scripting flaw caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that persist and execute when other users access the affected pages. The issue affects versions up to 7.4.2. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or official remediation details are currently available from the vendor or other sources.

Successful exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary scripts in the context of users visiting affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by disabling or restricting use of the affected plugin version. Implementing web application firewalls (WAF) with XSS protections may help mitigate risk. Monitor vendor communications for updates and apply patches promptly once available.