Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/4e5857fc-2984-4c8e-a519-ebd785932af1 İstismar kodu ya da analiz

Kayıt geçmişi

1. 28 Eki 2026 21:10CVSS puanı değişti: – → 7.1
2. 28 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 7,2 CVE-2026-96666Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
• 7,2 CVE-2026-96669Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
• 7,2 CVE-2026-96741DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
• 4,8 CVE-2026-113409The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to st…
• 4,8 CVE-2026-66092Stored XSS in pre-login notice via reachable legacy logon route
• 3,5 CVE-2026-118585configuroweb inventariobasico Add Product addlist.php cross site scripting