The Vulnerability is a Reflected Cross‑Site Scripting flaw in the Cozy Vision SMS Alert Order Notifications WordPress plugin. The bug allows an attacker to craft a malicious URL that injects executable JavaScript into the page generated by the plugin. The injection can execute in the context of any user who follows the crafted link, enabling the attacker to steal cookies, hijack sessions, or perform other client‑side attacks against affected WordPress sites.

Cozy Vision SMS Alert Order Notifications plugin for WordPress, versions up through and including 3.7.8. WordPress sites that have the plugin installed and configured to display order notifications are affected.

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS score of less than 1% suggests few known or confirmed exploits. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to reach a page that displays the reflected input, typically by luring a user to visit a crafted URL or by embedding malicious content in a link sent via SMS or email. The plugin processes user data without proper sanitization, making the attack vector a simple web‑based request to the affected WordPress site.