{"id":"CVE-2026-111021","aliases":[],"title":"Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"افزونه پیامک ووکامرس | Persian WooCommerce SMS","platforms":[],"versions":[{"version":"7.2.0","status":"affected","lessThan":"7.3.2","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-111021"}],"remediation":[],"description":"The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.","severity":"unknown","score":null,"published":"2026-10-28T06:00:24.132Z","modified":"2026-10-28T17:58:06.765Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/4e5857fc-2984-4c8e-a519-ebd785932af1/"],"sources":[{"name":"CVE","id":"CVE-2026-111021","modified":"2026-10-28T17:58:06.765Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111021"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:30:31.386Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}