CVE-2026-111021: افزونه پیامک ووکامرس | Persian WooCommerce SMS (WordPress plugin) · Cross-site Scripting
Affects افزونه پیامک ووکامرس | Persian WooCommerce SMS (WordPress plugin)Source CVE Database V5
Not known to be exploited : upgrade to 7.3.2 soon.
Data as of 28 Oct 2026, 06:27 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- Patch
- Available – fixed in 7.3.2
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade افزونه پیامک ووکامرس | Persian WooCommerce SMS (WordPress plugin) to 7.3.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| افزونه پیامک ووکامرس | Persian WooCommerce SMS | Affected
| Fixed in
|
AI-suggested
Upgrade the Persian WooCommerce SMS plugin to version 7.3.2 or later, where this vulnerability is fixed. No other mitigation is specified or required.
Description
A reflected cross-site scripting (XSS) vulnerability exists in the Persian WooCommerce SMS WordPress plugin versions 7.2.0 up to but not including 7.3.2. The plugin fails to properly sanitize and escape a parameter before reflecting it into an HTML attribute, which can lead to execution of malicious scripts in the browser session of a logged-in privileged user who is tricked into submitting a crafted request. This vulnerability is fixed in version 7.3.2.