CVE-2025-26984

WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Mar 3, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Reflected XSS.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8.

Analysis

AI-generated

Technical impact

The Vulnerability is a Reflected Cross‑Site Scripting flaw in the Cozy Vision SMS Alert Order Notifications WordPress plugin. The bug allows an attacker to craft a malicious URL that injects executable JavaScript into the page generated by the plugin. The injection can execute in the context of any user who follows the crafted link, enabling the attacker to steal cookies, hijack sessions, or perform other client‑side attacks against affected WordPress sites.

Affected Systems

Cozy Vision SMS Alert Order Notifications plugin for WordPress, versions up through and including 3.7.8. WordPress sites that have the plugin installed and configured to display order notifications are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS score of less than 1% suggests few known or confirmed exploits. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to reach a page that displays the reflected input, typically by luring a user to visit a crafted URL or by embedding malicious content in a link sent via SMS or email. The plugin processes user data without proper sanitization, making the attack vector a simple web‑based request to the affected WordPress site.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the plugin to the latest version (≥3.7.9) where input is properly sanitized.
  • If an upgrade is not immediately possible, remove or deactivate the SMS Alert Order Notifications plugin until a patch is applied.
  • Filter or encode all user‑supplied data before rendering in the WordPress front‑end to guard against XSS, following best practices for WordPress plugin security.

Generated by OpenCVE AI on May 1, 2026 at 14:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-5626 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications – WooCommerce allows Reflected XSS. This issue affects SMS Alert Order Notifications – WooCommerce: from n/a through 3.7.8.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications – WooCommerce allows Reflected XSS. This issue affects SMS Alert Order Notifications – WooCommerce: from n/a through 3.7.8. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Reflected XSS.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8.
First Time appeared Cozyvision
Cozyvision sms Alert Order Notifications
CPEs cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:*:wordpress:*:*
Vendors & Products Cozyvision
Cozyvision sms Alert Order Notifications
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications – WooCommerce allows Reflected XSS. This issue affects SMS Alert Order Notifications – WooCommerce: from n/a through 3.7.8.
Title WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Feb 17, 2025, 11:51 AM

View source JSON

Updated
Mar 3, 2025, 2:46 PM

JSON

Status
Analyzed
Published
Mar 3, 2025, 2:15 PM
Modified
Jun 26, 2026, 5:13 PM

View source JSON

No data.

Updated
May 1, 2026, 2:15 PM

JSON