CVE-2025-26994: Softdiscover Zigaform XSS Vulnerability

CVE-2025-26994 Overview

CVE-2025-26994 is a stored cross-site scripting (XSS) vulnerability in the Softdiscover Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The vulnerability affects all plugin versions up to and including 7.4.2. Exploitation requires user interaction but no authentication, and the scope changes to affect resources beyond the vulnerable component.

Critical Impact

Attackers can store malicious scripts that execute against site visitors and administrators, enabling session theft, credential harvesting, and administrative action hijacking on WordPress sites running the plugin.

Affected Products

• Softdiscover Zigaform – Price Calculator & Cost Estimation Form Builder Lite (WordPress plugin)
• All versions from initial release through 7.4.2
• WordPress sites with the zigaform-calculator-cost-estimation-form-builder-lite plugin installed and active

Discovery Timeline

• 2025-03-03 - CVE-2025-26994 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26994

Vulnerability Analysis

The vulnerability resides in how the Zigaform plugin processes and renders user-controlled input in generated pages. Input passed to plugin form fields or configuration parameters is not adequately sanitized or output-encoded before being rendered in HTML context. This allows an attacker to submit HTML and JavaScript payloads that persist in the WordPress database. When a legitimate user, including administrators, subsequently loads a page containing the stored content, the injected script executes in the browser under the site's origin.

The stored nature of this XSS increases its severity relative to reflected variants. Payloads remain active until an administrator manually removes them. The changed scope in the attack profile indicates that the injected script can access resources outside the vulnerable plugin's own security context, including the WordPress admin interface.

Root Cause

The root cause is missing or insufficient input sanitization and output encoding in the plugin's form input handlers and rendering logic. Developer-provided sanitization routines fail to strip or encode dangerous HTML elements and event handler attributes before storage or rendering. WordPress functions such as wp_kses, esc_html, and esc_attr are either bypassed or not applied to the affected fields.

Attack Vector

An unauthenticated attacker submits a crafted request containing an XSS payload through a plugin-controlled input surface. The payload is stored in the WordPress database. When a victim loads a page or admin screen that renders the stored content, the script executes with the victim's privileges. Successful exploitation can lead to session cookie theft, forced administrative actions via forged requests, redirection to attacker-controlled infrastructure, and drive-by malware delivery. Technical specifics of the vulnerable parameter are described in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-26994

Indicators of Compromise

• Unexpected <script>, <iframe>, <svg>, or on* event handler attributes stored in WordPress post content, options, or plugin-specific tables
• Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages containing Zigaform forms
• New or modified WordPress administrator accounts appearing without corresponding legitimate provisioning activity
• Anomalous session token reuse from geolocations inconsistent with the administrator's normal activity

Detection Strategies

• Audit database tables and plugin option values for HTML tags and JavaScript keywords such as <script, javascript:, onerror=, and onload=
• Deploy Content Security Policy (CSP) reporting to surface inline script execution attempts on pages rendered by the plugin
• Review web server access logs for POST requests to Zigaform endpoints containing URL-encoded HTML control characters

Monitoring Recommendations

• Enable WordPress audit logging to record plugin configuration changes and form submissions containing suspicious payloads
• Monitor administrator session activity for unexpected privilege changes, plugin installations, or theme edits
• Correlate outbound network telemetry from workstations used for WordPress administration against known malicious infrastructure

How to Mitigate CVE-2025-26994

Immediate Actions Required

• Identify all WordPress instances with the Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin installed at version 7.4.2 or earlier
• Deactivate the plugin until a vendor-supplied patched version is available and validated
• Rotate WordPress administrator credentials and invalidate active sessions on affected sites
• Inspect the database for stored XSS payloads and purge any malicious content from plugin-related records

Patch Information

As of the last NVD update on 2026-06-17, the advisory identifies affected versions up to and including 7.4.2. Site administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed release and update to the patched version once published by Softdiscover.

Workarounds

• Deactivate and remove the plugin if a patched version is not yet available
• Deploy a web application firewall (WAF) with rules blocking HTML tags and JavaScript event handlers in requests targeting plugin endpoints
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Restrict access to WordPress administration pages by IP allowlist to reduce exposure of authenticated sessions to stored payloads

# Example WordPress CLI commands to identify and deactivate the vulnerable plugin
wp plugin list --status=active | grep zigaform-calculator-cost-estimation-form-builder-lite
wp plugin deactivate zigaform-calculator-cost-estimation-form-builder-lite
wp plugin get zigaform-calculator-cost-estimation-form-builder-lite --field=version