CVE-2026-7462 is a reflected cross-site scripting vulnerability in the VatanSMS WP SMS plugin for WordPress, affecting all versions up to and including 1.01. The vulnerability is due to improper neutralization of input in the 'page' parameter, which is not sufficiently sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject malicious scripts that execute when an administrator interacts with a crafted link. The CVSS 3.1 base score is 6.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability.

An attacker can perform reflected XSS attacks by injecting malicious scripts via the 'page' parameter. This can lead to unauthorized script execution in the context of an administrator's browser session, potentially allowing theft of session tokens, defacement, or other actions limited by the administrator's privileges. The impact is limited to confidentiality and integrity with no direct availability impact. Exploitation requires social engineering to convince an administrator to click a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links that interact with the 'page' parameter in the VatanSMS WP SMS plugin. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.