CVE-2026-6696 is a reflected cross-site scripting vulnerability in the Zingaya Click-to-Call WordPress plugin affecting all versions up to 1.0. The issue stems from improper neutralization of input during web page generation, specifically in the 'email', 'first_name', 'last_name', and 'phone' parameters on the plugin's sign-up admin page. An attacker can exploit this by tricking a user into clicking a malicious link, causing arbitrary script execution in the context of the affected site. The vulnerability is unauthenticated and has a CVSS 3.1 base score of 6.1, indicating medium severity. There is no vendor-provided patch or official remediation at this time.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected site via reflected XSS. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of web content, but does not affect availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links related to the plugin's sign-up admin page parameters. Consider disabling or restricting access to the vulnerable plugin functionality if feasible.