The Zingaya Click‑to‑Call plugin for WordPress contains a reflected cross‑site scripting vulnerability in the sign‑up admin page. Because the 'email', 'first_name', 'last_name', and 'phone' parameters are not sanitized or escaped before being echoed back to the page, an attacker can supply malicious script content through these fields. When a victim opens a crafted URL that includes these parameters, the browser will execute the injected script, potentially stealing session cookies or performing further malicious actions. This flaw is classified as CWE‑79.

All releases of the plugin up to and including version 1.0 are affected. The problem appears in the sign‑up admin page of the plugin used on WordPress installations; any site running Zingaya Click‑to‑Call 1.0 or earlier is vulnerable.

The CVSS base score of 6.1 reflects a moderate severity. The flaw is exploitable by unauthenticated users through a user‑targeted link, meaning any visitor can be tricked into visiting a malicious URL. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that no large‑scale attacks have yet been reported. Nevertheless, pending exploitation is possible, especially on sites that expose the admin page to untrusted visitors.