Cross-site Scripting Vulnerability in Persian Woocommerce SMS by PersianScript
CVE-2026-22352

7.1HIGH

Key Information:

Vendor

WordPress
Status
Persian WooCommerce Sms
Vendor
CVE Published:
20 February 2026

What is CVE-2026-22352?

The Persian Woocommerce SMS plugin by PersianScript is susceptible to a Cross-site Scripting (XSS) vulnerability due to improper handling of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's browser. Affected versions of the plugin include all versions up to and including 7.1.1, enabling reflected XSS attacks which can compromise user data and session information.

Affected Version(s)

Persian Woocommerce SMS 0 <= 7.1.1

References

https://patchstack.com/database/Wordpress/Plugin/persian-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds | Patchstack Bug Bounty Program
.