The vulnerability is a CWE-79 reflected cross‑site scripting flaw located in the admin settings interface of the WordPress International SMS for Contact Form plugin. An attacker can inject malicious JavaScript into the page parameter of class‑sms‑log‑display.php. When an administrator visits a crafted URL containing the malicious payload, the script runs in that administrator’s browser, allowing the attacker to manipulate the site’s interface, steal session cookies or credentials, or perform other client‑side attacks.

The affected product is the WordPress plugin International Sms For Contact Form by Varun Sridharan. The vulnerability exists in version 1.2 of the plugin.

The vulnerability is a CWE-79 reflected XSS flaw. The CVSS score of 5.1 indicates a moderate severity vulnerability. No EPSS data is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is reflected: an attacker must provide a crafted URL to an administrator who is logged into the WordPress admin panel. Successful exploitation would allow the attacker to execute arbitrary JavaScript within the administrator’s browser session, potentially leading to credential theft, defacement, or other malicious actions