CVE-2026-111021Published

Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

Exact source revision recorded 28 Oct 2026 07:06:08 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-111021

Published

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.

Source published: 28 Oct 2026 06:00:24 UTC
Source modified: 28 Oct 2026 06:00:24 UTC
Observed here: 28 Oct 2026 07:06:08 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.