{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22352", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-07T12:21:19.920Z", "datePublished": "2026-02-20T15:47:00.914Z", "dateUpdated": "2026-04-28T16:48:04.130Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "persian-woocommerce-sms", "product": "Persian Woocommerce SMS", "vendor": "PersianScript", "versions": [{"lessThanOrEqual": "7.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Bonds | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:03:54.502Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.<p>This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:41.313Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/persian-woocommerce-sms/vulnerability/wordpress-persian-woocommerce-sms-plugin-7-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T21:25:42.648228Z", "id": "CVE-2026-22352", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T16:48:04.130Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-22352", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T21:25:42.648228Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T21:23:02.692Z"}}], "cna": {"title": "WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Bonds | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "Reflected XSS"}]}], "affected": [{"vendor": "PersianScript", "product": "Persian Woocommerce SMS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.1.1"}], "packageName": "persian-woocommerce-sms", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:03:54.502Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/persian-woocommerce-sms/vulnerability/wordpress-persian-woocommerce-sms-plugin-7-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.<p>This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T14:13:35.637Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22352", "state": "PUBLISHED", "dateUpdated": "2026-04-01T14:13:35.637Z", "dateReserved": "2026-01-07T12:21:19.920Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-20T15:47:00.914Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1."}, {"lang": "es", "value": "Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') vulnerabilidad en PersianScript Persian Woocommerce SMS persian-woocommerce-sms permite XSS Reflejado. Este problema afecta a Persian Woocommerce SMS: desde n/a hasta &lt;= 7.1.1."}], "id": "CVE-2026-22352", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-02-20T16:22:34.397", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/persian-woocommerce-sms/vulnerability/wordpress-persian-woocommerce-sms-plugin-7-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.1.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Persian Woocommerce SMS", "source": "cna", "vendor": "PersianScript"}, "product": "persian_woocommerce_sms", "vendor": "persianscript"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:21:51.520152+00:00", "value": {"mitigation_remediation": ["Apply the latest Persian Woocommerce SMS plugin release that addresses the reflected XSS flaw, or revert to a version known to be safe.", "As an interim measure, ensure all input fields handled by the plugin are properly escaped or sanitized using WordPress's recommended functions such as esc_html or wp_filter_nohtml.", "Scan your WordPress site for injected scripts or unexpected redirects, and enable logging to detect any attempted XSS exploitation."], "summary": {"action": "Patch Immediately", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the PersianScript Persian Woocommerce SMS WordPress plugin on all versions up to and including 7.1.1. No specific downstream product discontinuation is listed, therefore any WordPress installation that has this plugin installed at a vulnerable version is at risk.", "description_and_impact": "The Persian Woocommerce SMS plugin contains an improper input sanitization flaw that allows attackers to inject malicious script into the web page it renders. This reflected XSS can be exploited by injecting arbitrary client\u2011side code via user\u2011controlled input fields, potentially leading to credential theft, session hijacking, defacement or navigation to malicious sites. The flaw is identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 7.1 indicates high impact, but the EPSS score of <1% suggests that exploitation attempts are currently rare. The plugin is publicly accessible to website visitors, so an attacker can submit a crafted request from any external source to trigger the reflected script. Since the vulnerability is not listed in KEV, no widespread malicious activity has been officially documented yet. Nevertheless, the flaw presents a clear opportunity for attackers to compromise user data or manipulate site content."}}}}, "created": "2026-02-23T14:36:41.853450+00:00", "updated": "2026-04-16T06:30:06.019808+00:00", "vendors": ["persianscript", "persianscript$PRODUCT$persian_woocommerce_sms", "wordpress", "wordpress$PRODUCT$wordpress"]}