The vulnerability is a DOM‑based cross‑site scripting flaw that allows attackers to inject malicious JavaScript into the victim’s browser context. By exploiting improper neutralization of input during page generation, an attacker can influence the content of the page presented to a user, potentially leading to credential theft, session hijacking, or defacement. The weakness is identified as a classic input handling issue (CWE‑79).

VeronaLabs WP SMS plugin for WordPress, versions up to and including 7.1, is affected. Users running any WP SMS installation with a version number 7.1 or lower are exposed.

The CVSS score of 5.9 classifies it as a medium severity vulnerability. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Although no explicit attack surface is detailed in the description, the likely vector involves an attacker controlling or influencing input that is reflected into the DOM, such as URLs or form fields. Exploitation would require the victim to visit a crafted page or interact with a manipulated interface provided by the plugin. The lack of a local‑only restriction suggests that remote attackers could trigger it by targeting vulnerable sites directly.