What is the CVSS score of CVE-2026-7462?

CVE-2026-7462 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

VatanSMS WP SMS CVE-2026-7462

EUVD-2026-31027 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 Wordfence

GHSA-hwxr-fwcp-hjvm

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:37 vuln.today

DescriptionCVE.org

The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the VatanSMS WP SMS WordPress plugin (all versions through 1.01) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized page parameter, executing in the context of a logged-in administrator's browser session. Exploitation requires social engineering an administrator into clicking a crafted link, making this a medium-severity but realistic threat vector for WordPress site takeover or credential theft. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS, rooted in insufficient input sanitization of the page GET parameter before it is echoed back into HTML output. Source code references confirm the flaw spans at least three admin-side PHP files: groups.php (line 34), outbox.php (line 5), and subscribers.php (line 128), all located under the plugin's admin include tree. The affected CPE is cpe:2.3:a:vatanyazilim:vatansms_wp_sms:*:*:*:*:*:*:*:*, indicating all plugin versions up to and including 1.01 are affected. Because the vulnerable endpoints reside in admin-facing pages, the injected payload executes with the privileges of the administrator's authenticated browser session, making the Scope metric Changed (S:C) in the CVSS vector accurate - the impact crosses from the plugin context into the broader WordPress session.

RemediationAI

The primary remediation is to update the VatanSMS WP SMS plugin beyond version 1.01; however, no specific patched version number is confirmed in the available data - administrators should check the WordPress plugin repository or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/96ef8459-1600-4ca0-93c6-0ee42f8adabd for the latest available release. If a patched version is not yet available, the most effective compensating control is to deactivate and remove the plugin entirely until a fix is published, as the vulnerable endpoints are part of core admin functionality that cannot be selectively disabled without modifying plugin code. As a secondary mitigation, WordPress administrators should be cautioned against clicking unsolicited links related to plugin admin pages, and a Web Application Firewall (such as Wordfence's own firewall) can be configured to block reflected XSS payloads in query parameters, though this adds operational overhead and may not cover all payload variants.