CVE-2025-26542: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Zalo Live Chat WordPress plugin, tracked as CVE-2025-26542. The vulnerability affects versions up to 1.1.0 of the plugin and was discovered by researcher Abdi Pranata. The issue was publicly disclosed on March 20, 2025, and was last updated on March 26, 2025 (NVD, Wordfence).

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation. It has received a CVSS v3.1 Base Score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

The vulnerability allows for Reflected Cross-Site Scripting attacks, which could potentially lead to unauthorized access to sensitive information, manipulation of web content, and compromise of user sessions. The CVSS scoring indicates potential impacts on confidentiality, integrity, and availability, all rated as Low (NVD).

Users of the Zalo Live Chat WordPress plugin should upgrade to a version newer than 1.1.0 when available. As this is a recently disclosed vulnerability, users should monitor official plugin channels for security updates (NVD).