Vatansms Wp Sms
Monthly
Reflected Cross-Site Scripting in the VatanSMS WP SMS WordPress plugin (all versions through 1.01) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `page` parameter, executing in the context of a logged-in administrator's browser session. Exploitation requires social engineering an administrator into clicking a crafted link, making this a medium-severity but realistic threat vector for WordPress site takeover or credential theft. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Reflected Cross-Site Scripting in the VatanSMS WP SMS WordPress plugin (all versions through 1.01) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `page` parameter, executing in the context of a logged-in administrator's browser session. Exploitation requires social engineering an administrator into clicking a crafted link, making this a medium-severity but realistic threat vector for WordPress site takeover or credential theft. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.