All vulnerabilities
CVE-2026-111021

Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

Unknown افزونه پیامک ووکامرس | Persian WooCommerce SMS
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7.3.2Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 7.3.2افزونه پیامک ووکامرس | Persian WooCommerce SMSCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.

Text from CVE List

Affected versions 1

  • افزونه پیامک ووکامرس | Persian WooCommerce SMSaffected: 7.2.0 before 7.3.2CVE List

References 1