Persian WooCommerce SMS EUVD-2026-111715

Exploitation requires a logged-in privileged user (e.g., a WordPress administrator) of a site running Persian WooCommerce SMS versions 7.2.0 up to but not including 7.3.2 to be socially engineered into submitting a crafted cross-site request; the attacker-controlled parameter is then reflected without sanitization or escaping into an HTML attribute, executing script in that user's authenticated session. The attacker themselves is unauthenticated (PR:N), but the following factors limit real-world exploitation: mandatory user interaction by a privileged victim (UI:R), the need to target a specific high-privilege account, and the restricted affected version range - sites on 7.3.2 or later are not affected.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals largely agree. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) describes a network-reachable flaw an unauthenticated attacker can trigger with low complexity, but it is gated by UI:R - a logged-in privileged user must be tricked into submitting a crafted cross-site request - which materially reduces real-world exploitability. The EPSS score is low at 0.17% (6th percentile), consistent with a reflected XSS in a niche plugin that requires social engineering rather than mass automated exploitation. It is NOT on CISA KEV, and there is no public exploit identified at time of analysis (only a WPScan advisory and the NVD mirror are referenced, neither verified as working exploit code). The vuln.today decision label is 'this_week', indicating a prompt-but-not-crisis remediation posture, which aligns with a patched (7.3.2) medium-severity bug. The main consistency note: the CVSS claims C:L/I:L/A:L with S:C, which is the standard scoring convention for XSS where script runs in the victim's authenticated browser context; the actual damage depends on what the targeted privileged user can do. No conflicting data was found, but note the attacker is unauthenticated (PR:N) while the VICTIM must be an authenticated privileged user - these are distinct and should not be conflated.

An attacker crafts a malicious link or auto-submitting page containing a payload in the vulnerable parameter and lures a logged-in WordPress administrator (or other privileged user) of a site running Persian WooCommerce SMS into visiting it. Because the parameter is reflected unescaped into an HTML attribute, the script executes in the admin's authenticated session, allowing session-context actions such as creating accounts or altering plugin settings. No verified public exploit code was identified; a WPScan advisory reference exists.