The vulnerability is a reflected cross‑site scripting flaw in the page parameter of the admin settings interface of WordPress International SMS for Contact Form 7 Integration version 1.2. Attackers can inject malicious scripts via the page parameter in class‑sms‑log‑display.php, which causes arbitrary JavaScript to execute in an administrator’s browser. A crafted URL containing malicious payloads can be delivered to a logged‑in administrator, enabling the attacker to manipulate the site’s interface, steal session cookies or credentials, or perform other client‑side attacks.

The affected product is the WordPress plugin International Sms For Contact Form by Varun Sridharan. The vulnerability exists in version 1.2 of the plugin.

The vulnerability is a CWE‑79 reflected XSS flaw. The CVSS score of 5.1 indicates a moderate severity vulnerability. The EPSS score is < 1 % indicating a very low exploitation probability, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is reflected: an attacker must provide a crafted URL to an administrator who is logged into the WordPress admin panel. Successful exploitation would allow the attacker to execute arbitrary JavaScript within the administrator’s browser session, potentially leading to credential theft, defacement, or other malicious actions.