Executive Summary

CVE-2026-22352 is a medium severity Cross Site Scripting (XSS) vulnerability affecting the WordPress Persian Woocommerce SMS Plugin versions up to and including 7.1.1.

This vulnerability allows an attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website, which execute when visitors access the compromised site.

Exploitation requires user interaction by a privileged user who must perform an action like clicking a malicious link, visiting a crafted page, or submitting a form.

The vulnerability falls under the OWASP Top 10 category A3: Injection and is classified specifically as Cross Site Scripting (XSS).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to inject malicious scripts into your website, which can execute when visitors access the site.

• Attackers can perform redirects to malicious sites.
• Attackers can display unwanted advertisements.
• Attackers can inject other harmful HTML payloads that compromise user experience or security.

Since exploitation requires user interaction by a privileged user, it can lead to unauthorized actions or data exposure if such users are tricked.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a reflected Cross Site Scripting (XSS) issue in the Persian Woocommerce SMS WordPress plugin up to version 7.1.1. Detection typically involves monitoring for suspicious input being reflected in web pages without proper neutralization.

Since no official patch is available and the vulnerability requires user interaction such as clicking a malicious link or submitting a crafted form, detection can include analyzing web server logs for unusual URL parameters or payloads that might trigger the XSS.

Specific commands are not provided in the available resources, but common approaches include using web vulnerability scanners that test for reflected XSS or manual testing by injecting typical XSS payloads into input fields or URL parameters related to the plugin.

Useful 0 Not Useful 0

Mitigation Strategies

As of the report date, no official patch is available for this vulnerability.

Patchstack has issued a mitigation rule to block attacks targeting this flaw. Users are advised to apply these mitigations immediately to protect their websites.

Immediate steps include implementing the mitigation rules provided by Patchstack, monitoring for suspicious activity, and restricting user interactions that could trigger the vulnerability until an official patch is released.

Useful 0 Not Useful 0