The Persian WooCommerce SMS plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses the remove_query_arg function on URL parameters without proper escaping, enabling injection of malicious scripts. This vulnerability affects all versions up to and including 7.0.2. An unauthenticated attacker can exploit this by crafting a malicious URL that, when clicked by a user, executes arbitrary JavaScript in the context of the affected site. The CVSS 3.1 base score is 6.1, reflecting a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The impact includes limited confidentiality and integrity loss without availability impact. No patch or official fix has been documented yet.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable website for users who click on a malicious link. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of displayed content. There is no impact on system availability. The vulnerability does not require authentication but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links related to the affected plugin. Website administrators should monitor for updates from the plugin vendor and apply patches promptly once released. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads may provide temporary mitigation.