What is the CVSS score of CVE-2026-6696?

CVE-2026-6696 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Zingaya Click-to-Call CVE-2026-6696

EUVD-2026-27201 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

GHSA-qvrg-xmf8-qrhj

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:30 vuln.today

DescriptionCVE.org

The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'first_name', 'last_name', and 'phone' parameters on the plugin's sign-up admin page in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected cross-site scripting in Zingaya Click-to-Call WordPress plugin up to version 1.0 allows unauthenticated attackers to inject arbitrary web scripts via the email, first_name, last_name, and phone parameters on the plugin's admin sign-up page. The vulnerability requires user interaction (clicking a malicious link) and results in session hijacking, credential theft, or defacement within the WordPress admin context. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability resides in the plugin's admin sign-up page (zingaya-admin.php) where user-supplied input from GET or POST parameters is reflected directly into HTML output without proper sanitization or escaping. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw. The affected parameters (email, first_name, last_name, phone) are echoed back to the page at lines 62, 71, 79, and 104 of zingaya-admin.php without using WordPress escaping functions such as esc_attr(), esc_html(), or esc_url(). The CPE cpe:2.3:a:zingaya:zingaya_click-to-call:*:*:*:*:*:*:*:* indicates all versions up to 1.0 are affected.

RemediationAI

Update the Zingaya Click-to-Call plugin to a patched version released after version 1.0. If no patched version is available from the vendor, disable or remove the plugin entirely. For environments unable to immediately remove the plugin, implement a compensating control by restricting access to the plugin's admin sign-up page (typically wp-admin/) via web application firewall rules or HTTP authentication, limiting exposure to trusted administrators only. Additionally, apply WordPress security hardening: remove query parameters containing user input from logged-in admin URLs in email communications, and educate WordPress administrators to avoid clicking suspicious links even from apparently internal sources. Verify the fix by testing the email, first_name, last_name, and phone parameters with XSS payloads (e.g., <script>alert(1)</script>) to confirm that input is properly escaped in HTML output.