The SMS for WordPress plugin contains a reflected XSS flaw caused by insufficient sanitization of the paged parameter. The flaw allows an unauthenticated attacker to embed arbitrary JavaScript that is reflected back into the page when the parameter is displayed. The injected script runs in the victim’s browser, enabling any browser‑based action permitted by the victim's session, such as session hijacking, phishing, or defacement. The vulnerability is classified as CWE‑79.

The vulnerability affects all releases of the SMS for WordPress plugin by Stanley Choi up to and including version 1.1.8. No other vendors or products are listed as impacted in the CNA data, so the scope is limited to this plugin only.

The CVSS score of 6.1 denotes a medium severity. An EPSS score of less than 1% indicates a low likelihood of exploitation at the moment, and the issue is not in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a crafted URL that contains malicious JavaScript within the paged parameter. No authentication is required, and the malicious code is executed client‑side when a user opens the affected URL. The attacker can then perform any action that the victim’s browser permits, potentially compromising confidentiality, integrity, or availability of the site from the victim’s perspective.