افزونه پیامک ووکامرس | Persian WooCommerce SMS
CVE-2026-111021: The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML
CVE-2026-111021 Oct 28, 2026 Source: Vendor
The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-111021
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1
CVE-2026-111021
BR2026-0000-037008
unclaimed
Credited as Zahid Abbasi