Persian Woocommerce Sms Vulnerabilities

The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...

CVSS:

4.9

Affected:

up to 7.2.2

Fix:

No patched version reported

Disclosed:

Jul 23, 2026

CVE-2026-65532 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.

Affected:

up to 7.1.1

Fix:

No patched version reported

Disclosed:

Feb 20, 2026

CVE-2026-22352 on NVD →

The Persian Woocommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succ...

CVSS:

6.1

Affected:

up to 7.1.1

Fix:

No patched version reported

Disclosed:

Feb 11, 2026

CVE-2026-22352 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PersianScript Persian Woocommerce SMS allows SQL Injection. This issue affects Persian Woocommerce SMS: from n/a through 7.0.10.

Affected:

up to 7.1.0

Fixed in:

7.1.0

Disclosed:

Jun 6, 2025

CVE-2025-49315 on NVD →

The Persian Woocommerce SMS plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level...

CVSS:

4.9

Affected:

up to 7.0.10

Fixed in:

7.1.0

Disclosed:

Jun 5, 2025

CVE-2025-49315 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ووکامرس فارسی Persian Woocommerce SMS allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through 7.0.5.

Affected:

up to 7.0.6

Fixed in:

7.0.6

Disclosed:

Dec 13, 2024

CVE-2024-54312 on NVD →

The Persian Woocommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succ...

CVSS:

6.1

Affected:

up to 7.0.5

Fixed in:

7.0.6

Disclosed:

Dec 11, 2024

CVE-2024-54312 on NVD →

[en] The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web...

Affected:

up to 7.0.6

Fixed in:

7.0.6

Disclosed:

Dec 7, 2024

CVE-2024-10046 on NVD →

The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVSS:

6.1

Affected:

up to 7.0.5

Fixed in:

7.0.6

Disclosed:

Dec 6, 2024

CVE-2024-10046 on NVD →

[en] The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web...

Affected:

up to 7.0.3

Fixed in:

7.0.3

Disclosed:

Oct 17, 2024

CVE-2024-9213 on NVD →

The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVSS:

6.1

Affected:

up to 7.0.2

Fixed in:

7.0.3

Disclosed:

Oct 16, 2024

CVE-2024-9213 on NVD →

The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to SQL Injection and Cross-Site Scripting via many methods in versions up to and including 4.4.0.

CVSS:

6.4

Affected:

up to 4.4.0

Fixed in:

4.4.1

Disclosed:

Apr 5, 2022

The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to SQL Injection and Cross-Site Scripting via many methods in versions up to and including 4.4.0.

Affected:

up to 4.4.1

Fixed in:

4.4.1

Disclosed:

Apr 5, 2022

[en] The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.

Affected:

up to 3.3.4

Fixed in:

3.3.4

Disclosed:

Sep 17, 2019

CVE-2016-10987 on NVD →

The persian-woocommerce-sms plugin before 3.3.3 for WordPress has ps_sms_numbers XSS.

CVSS:

6.1

Affected:

up to 3.3.2

Fixed in:

3.3.3

Disclosed:

Apr 21, 2016

CVE-2016-10987 on NVD →

This plugin is prone to a cross site scripting vulnerability, because "ps_sms_numbers" parameter is not sanitized. Update the plugin.

Affected:

up to 3.3.4

Fixed in:

3.3.4

Disclosed:

Apr 21, 2016