CVE-2026-111021: Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

Q: Who is exposed to exploitation?

A logged-in privileged user must be tricked into submitting a crafted cross-site request. The injected script executes in that privileged user’s browser session.

Q: Which versions need remediation?

Versions 7.2.0 through 7.3.1 are affected. The issue is fixed in version 7.3.2.

Q: What input is involved in the attack?

The vulnerable input is the pwsms_mobiles parameter, which is reflected into an HTML attribute without sufficient sanitization and escaping.

Published Oct 28, 2026

Updated

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.

Affected Software

1 affected component

Persian WooCommerce SMS<7.3.2

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to exploitation?

A logged-in privileged user must be tricked into submitting a crafted cross-site request. The injected script executes in that privileged user’s browser session.

Which versions need remediation?

Versions 7.2.0 through 7.3.1 are affected. The issue is fixed in version 7.3.2.

What input is involved in the attack?

The vulnerable input is the pwsms_mobiles parameter, which is reflected into an HTML attribute without sufficient sanitization and escaping.

CVE-2026-111021: Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

Affected Software

Event History

Frequently Asked Questions

Who is exposed to exploitation?

Which versions need remediation?

What input is involved in the attack?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

Which versions need remediation?

What input is involved in the attack?