What is the CVSS score of CVE-2025-26984?

CVE-2025-26984 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-26984?

Within 24 hours: Identify all WordPress installations running SMS Alert Order Notifications plugin version 3.7.8 or earlier and disable the plugin pending vendor patch release; enable WordPress security logging to detect XSS payload attempts. Within 7 days: Document all plugin instances across the organization; communicate with plugin vendor (Patchstack) regarding patch timeline; implement content security policy (CSP) headers with script-src restrictions on affected WordPress sites. Within 30 days: Upon vendor patch release, test and deploy patched version; audit WordPress user roles and capabilities to restrict plugin access to administrators only; conduct user security awareness training on phishing and malicious link recognition.

SMS Alert Order Notifications CVE-2025-26984

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

WordPress XSS Sms Alert Order Notifications

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 26, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Jun 26, 2026 - 17:22 NVD

7.1 (HIGH) 6.1 (MEDIUM)

Analysis Updated

Apr 25, 2026 - 00:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

MEDIUM HIGH

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.1 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

MEDIUM 6.1

DescriptionNVD

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications - WooCommerce allows Reflected XSS. This issue affects SMS Alert Order Notifications - WooCommerce: from n/a through 3.7.8.

AnalysisAI

Reflected Cross-Site Scripting (XSS) in the SMS Alert Order Notifications WordPress plugin through version 3.7.8 enables remote attackers to execute arbitrary JavaScript in victim browsers by tricking users into clicking malicious links. The vulnerability carries a CVSS score of 7.1 due to changed scope (cross-domain consequences), though exploitation requires user interaction. EPSS probability is low (0.08%, 25th percentile), indicating limited observed exploitation activity. No CISA KEV listing confirms active widespread exploitation, though Patchstack's vulnerability database disclosure suggests the flaw may be targeted in WordPress-specific attack campaigns.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the SMS Alert Order Notifications plugin for WooCommerce/WordPress (CPE: cpe:2.3:a:cozyvision:sms_alert_order_notifications). The plugin fails to properly sanitize user-supplied input before reflecting it in HTTP responses, allowing attackers to inject malicious JavaScript payloads. As a reflected XSS vulnerability, the attack vector is network-based but requires social engineering - the malicious payload must be delivered via crafted URL parameters that victims are induced to access. The CVSS vector indicates changed scope (S:C), meaning successful exploitation can affect resources beyond the vulnerable component's security scope, potentially compromising user sessions across WordPress domains or integrated WooCommerce storefronts.

RemediationAI

WordPress administrators should immediately upgrade the SMS Alert Order Notifications plugin to version 3.7.9 or later if available, verifying the fix through the WordPress plugin repository or Cozy Vision's official channels. As no explicit patch version is confirmed in the provided references, site owners should monitor Patchstack's advisory at https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/ for updated remediation guidance and contact Cozy Vision directly for patch status confirmation. As a compensating control until patching, implement Content Security Policy (CSP) headers with strict 'script-src' directives to mitigate XSS payload execution, though this may break legitimate plugin functionality requiring inline scripts. Additionally, deploy Web Application Firewall (WAF) rules to detect and block common XSS patterns in URL parameters targeting the vulnerable plugin endpoints, noting this provides detection rather than true remediation and may generate false positives on legitimate special characters in order notifications. For high-risk environments, temporarily disable the plugin if SMS notification functionality is non-critical to business operations, accepting the trade-off of lost order notification capabilities against XSS exposure.