CVE-2024-10046 is a reflected cross-site scripting vulnerability in the Persian WooCommerce SMS WordPress plugin caused by improper neutralization of input during web page generation (CWE-79). The plugin uses the remove_query_arg function without appropriate escaping on URL parameters, enabling unauthenticated attackers to inject arbitrary scripts. This vulnerability affects all versions up to and including 7.0.5. Successful exploitation requires user interaction, such as clicking a malicious link, which then executes injected scripts in the context of the victim's browser session.

An attacker can inject and execute arbitrary web scripts in the context of a victim's browser by tricking them into clicking a malicious link. This can lead to limited confidentiality and integrity impacts, such as theft of session cookies or manipulation of displayed content. There is no indication of availability impact or known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking untrusted links that interact with the plugin's functionality. Monitoring for updates from the plugin vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.