Stored Cross-Site Scripting in WooCommerce SMS Alert Plugin

CVE-2025-3878

What is CVE-2025-3878?

The SMS Alert Order Notifications plugin for WooCommerce is susceptible to stored cross-site scripting through the sa_verify shortcode. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data breaches.

References