Live › vulnerability › CVE-2026-111021
Go to dashboardThe Persian WooCommerce SMS WordPress plugin reflects an unsanitised parameter into an HTML attribute before version 7.3.2. A crafted link can make a logged-in privileged user's browser run attacker script in their session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Persian WooCommerce SMS plugin before 7.3.2 with WooCommerce and WordPress admin users who can be sent a link. The exposure depends on a privileged user visiting an attacker-crafted URL, so sites without the plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/ and read its version.7.3.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.
This page as .md · .json · in your agent: get_signal("CVE-2026-111021")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.