VulnSocial

CVE-2026-6696Disclosure

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'first_name', 'last_name', and 'phone' parameters on the plugin's sign-up admin page in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-05: 2Technical Details · 2026-05-05: 205-05
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-6696 Reflected Cross-Site Scripting in Zingaya Click-to-Call WordPress ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6696 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The post announces CVE-2026-6696, a reflected XSS vulnerability in the Zingaya Click‑to‑Call WordPress plugin, with a link to more details but no exploitation code, patch, or active exploitation mention.

    0000052
    4.0K followersView on X
  • CVEarity@CVEarity
    Disclosure

    ⚡ New CVE Alert: CVE-2026-6696 📊 Severity: 6.1 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-6696 #CVE-2026-6696 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/7nTUmYmwJy

    Post summary

    The tweet announces the newly disclosed CVE‑2026‑6696 affecting WordPress with a medium severity score, but offers no further exploitation details or patch information.

    0000039
    151 followersView on X

Explore more

Back to dashboard