The vulnerability arises from the VatanSMS WP SMS plugin’s handling of the 'page' query parameter, which is not properly sanitized nor escaped before being reflected in the page source. This flaw allows attackers to embed malicious script code that will execute in the browser context of any administrator who follows a crafted link. The injected code can steal session cookies, perform unwanted actions on behalf of the admin, or facilitate further attacks against the site, thereby compromising confidentiality, integrity, and availability for the targeted WordPress installation.

WordPress sites that have the VatanSMS WP SMS plugin installed, at version 1.01 or earlier, provided by vatanyazilim.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of exploitation in the wild. However, given that the flaw can be triggered by simply enticing an administrator to click a link containing user supplied input, attackers can readily exploit the issue in environments where users do not perform rigorous link verification. The attack path requires no privileged access and relies only on social engineering, meaning that the risk to any site where administrators are likely to click suspicious links is high.