The vulnerability CVE-2026-25343 in VeronaLabs WP SMS plugin arises from improper neutralization of input during web page generation, resulting in a DOM-based cross-site scripting (XSS) issue. This affects WP SMS versions up to 7.1. The CVSS 3.1 base score is 5.9 (medium), with attack vector network, low attack complexity, requiring high privileges and user interaction, and impacts on confidentiality, integrity, and availability rated as low. No known exploits are reported in the wild, and no patch or official remediation information is currently available.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected application, potentially leading to limited disclosure or modification of data and partial disruption of service. The impact is rated medium severity with low confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, limit exposure by restricting high privilege user access and exercising caution with user interactions involving the WP SMS plugin. Monitor vendor channels for updates.