Cross-site Scripting Flaw in Zigaform – Form Builder Lite by Softdiscover

CVE-2025-26989

Summary

The Zigaform – Form Builder Lite plugin by Softdiscover is susceptible to a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can be stored and later executed in the browsers of unsuspecting users. Particularly, versions from n/a up to 7.4.2 exhibit this flaw, rendering them vulnerable to data theft, session hijacking, and other web-based attacks. It is imperative for users of this plugin to implement remediation strategies to safeguard against potential exploits.

References