CVE-2026-22352
Reflected XSS in Persian Woocommerce SMS Plugin
Publication date: 2026-02-20
Last updated on: 2026-02-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| persianscript | persian_woocommerce_sms | to 7.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22352 is a medium severity Cross Site Scripting (XSS) vulnerability affecting the WordPress Persian Woocommerce SMS Plugin versions up to and including 7.1.1.
This vulnerability allows an attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website, which execute when visitors access the compromised site.
Exploitation requires user interaction by a privileged user who must perform an action like clicking a malicious link, visiting a crafted page, or submitting a form.
The vulnerability falls under the OWASP Top 10 category A3: Injection and is classified specifically as Cross Site Scripting (XSS).
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject malicious scripts into your website, which can execute when visitors access the site.
- Attackers can perform redirects to malicious sites.
- Attackers can display unwanted advertisements.
- Attackers can inject other harmful HTML payloads that compromise user experience or security.
Since exploitation requires user interaction by a privileged user, it can lead to unauthorized actions or data exposure if such users are tricked.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a reflected Cross Site Scripting (XSS) issue in the Persian Woocommerce SMS WordPress plugin up to version 7.1.1. Detection typically involves monitoring for suspicious input being reflected in web pages without proper neutralization.
Since no official patch is available and the vulnerability requires user interaction such as clicking a malicious link or submitting a crafted form, detection can include analyzing web server logs for unusual URL parameters or payloads that might trigger the XSS.
Specific commands are not provided in the available resources, but common approaches include using web vulnerability scanners that test for reflected XSS or manual testing by injecting typical XSS payloads into input fields or URL parameters related to the plugin.
What immediate steps should I take to mitigate this vulnerability?
As of the report date, no official patch is available for this vulnerability.
Patchstack has issued a mitigation rule to block attacks targeting this flaw. Users are advised to apply these mitigations immediately to protect their websites.
Immediate steps include implementing the mitigation rules provided by Patchstack, monitoring for suspicious activity, and restricting user interactions that could trigger the vulnerability until an official patch is released.