The Persian Woocommerce SMS plugin contains an improper input sanitization flaw that allows attackers to inject malicious script into the web page it renders. This reflected XSS can be exploited by injecting arbitrary client‑side code via user‑controlled input fields, potentially leading to credential theft, session hijacking, defacement or navigation to malicious sites. The flaw is identified as CWE‑79.

This vulnerability affects the PersianScript Persian Woocommerce SMS WordPress plugin on all versions up to and including 7.1.1. No specific downstream product discontinuation is listed, therefore any WordPress installation that has this plugin installed at a vulnerable version is at risk.

The CVSS score of 7.1 indicates high impact, but the EPSS score of <1% suggests that exploitation attempts are currently rare. The plugin is publicly accessible to website visitors, so an attacker can submit a crafted request from any external source to trigger the reflected script. Since the vulnerability is not listed in KEV, no widespread malicious activity has been officially documented yet. Nevertheless, the flaw presents a clear opportunity for attackers to compromise user data or manipulate site content.