CVE-2025-26542: Zalo Live Chat XSS Vulnerability

CVE-2025-26542 Overview

CVE-2025-26542 is a reflected Cross-Site Scripting (XSS) vulnerability in the Dang Ngoc Binh Zalo Live Chat (zalo-live-chat) WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All plugin versions up to and including 1.1.0 are affected.

Attackers can craft malicious URLs that, when clicked by a victim, execute arbitrary JavaScript in the victim's browser within the context of the vulnerable site. Exploitation requires user interaction but no authentication. Successful attacks can lead to session theft, credential harvesting, or targeted actions performed on behalf of the victim.

Critical Impact

Reflected XSS allows attackers to execute arbitrary JavaScript in victim browsers, potentially compromising authenticated administrator sessions and enabling further site takeover.

Affected Products

• Dang Ngoc Binh Zalo Live Chat WordPress plugin (zalo-live-chat)
• All versions from n/a through 1.1.0
• WordPress sites running the vulnerable plugin

Discovery Timeline

• 2025-03-26 - CVE-2025-26542 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26542

Vulnerability Analysis

The Zalo Live Chat plugin fails to properly sanitize and encode user-controlled input before reflecting it back in HTTP responses. When a victim follows a crafted link containing malicious payload parameters, the plugin includes the attacker-controlled data directly within the rendered HTML response.

The vulnerability is categorized under [CWE-79]: Improper Neutralization of Input During Web Page Generation. Because the scope changes during exploitation, an attacker can impact resources beyond the vulnerable component, such as the WordPress administrator session context. The exploit requires user interaction, typically achieved through phishing or social engineering. The current EPSS probability is approximately 0.115% (29.86 percentile), indicating limited observed exploitation activity at this time.

Root Cause

The root cause lies in the plugin's request handling logic, which reflects HTTP request parameters into the response body without applying output encoding or input validation. Standard WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() are not applied to the relevant input fields before rendering.

Attack Vector

The vulnerability is exploitable over the network without authentication. An attacker constructs a URL pointing to the vulnerable plugin endpoint with a JavaScript payload embedded in a parameter. The attacker then delivers the link to a victim via phishing email, instant message, or a malicious referring site.

When the victim clicks the link, the injected script executes in the browser under the origin of the WordPress site. If the victim holds an authenticated session, the attacker can issue requests on their behalf, exfiltrate cookies that lack HttpOnly, or pivot to administrative functionality. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-26542

Indicators of Compromise

• HTTP requests to zalo-live-chat plugin endpoints containing URL-encoded <script>, javascript:, or onerror= patterns in query parameters
• Unusual Referer headers from external domains directing traffic to plugin URLs
• Outbound browser requests to attacker-controlled domains immediately following plugin page loads
• WordPress access logs showing repeated requests with suspicious parameter values targeting plugin paths

Detection Strategies

• Inspect web server access logs for plugin URLs containing HTML or JavaScript control characters such as <, >, ", and ' in query strings
• Deploy Web Application Firewall (WAF) signatures targeting reflected XSS payloads against the WordPress plugin namespace
• Correlate browser-side Content Security Policy (CSP) violation reports with server-side plugin request patterns

Monitoring Recommendations

• Enable verbose HTTP request logging for all /wp-content/plugins/zalo-live-chat/ paths
• Alert on administrator session activity originating from unusual geographic locations or user agents shortly after plugin URL visits
• Track outbound DNS queries from WordPress administrative workstations for domains observed in known XSS phishing campaigns

How to Mitigate CVE-2025-26542

Immediate Actions Required

• Disable or remove the Zalo Live Chat plugin (zalo-live-chat) until a patched release is available
• Audit WordPress administrator accounts for unauthorized changes, new users, or modified plugin and theme files
• Force password resets and invalidate active sessions for all privileged WordPress users
• Educate administrators to avoid clicking unsolicited links referencing the affected WordPress site

Patch Information

At the time of publication, no fixed version has been identified beyond 1.1.0. Monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an official update from the maintainer.

Workarounds

• Uninstall the plugin and replace it with a maintained alternative live chat solution
• Deploy a WAF rule that blocks requests containing script tags, event handlers, or javascript: URIs targeting zalo-live-chat endpoints
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Enable HttpOnly and Secure flags on session cookies to reduce the impact of successful XSS execution

# Example Apache mod_security rule to block obvious XSS payloads against the plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/zalo-live-chat/" \
    "id:1002601,phase:2,deny,status:403,\
    chain,msg:'Blocked reflected XSS attempt against zalo-live-chat (CVE-2025-26542)'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"