CVE-2025-26984: SMS Alert Order Notifications XSS Flaw

CVE-2025-26984 Overview

CVE-2025-26984 is a reflected cross-site scripting (XSS) vulnerability in the Cozy Vision SMS Alert Order Notifications plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. All plugin versions up to and including 3.7.8 are affected. The vulnerability requires user interaction and can lead to session hijacking, credential theft, or forced actions performed on behalf of the victim in the WordPress administrative context.

Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in the victim's browser, potentially compromising WooCommerce store administrator sessions and exposing customer order data.

Affected Products

Cozy Vision SMS Alert Order Notifications for WordPress (versions up to and including 3.7.8)
WordPress sites running the sms-alert plugin with WooCommerce integration
Any WordPress deployment using the free version of the plugin distributed via wordpress.org

Discovery Timeline

2025-03-03 - CVE-2025-26984 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2025-26984

Vulnerability Analysis

The vulnerability is a reflected XSS flaw within the SMS Alert Order Notifications plugin. The plugin fails to properly sanitize and encode user-controllable input before reflecting it back into HTTP responses rendered by the browser. An attacker crafts a URL containing malicious JavaScript payloads in vulnerable request parameters. When a victim, typically an authenticated WordPress administrator or store operator, clicks the crafted link, the payload executes in the browser under the plugin's origin.

The attack proceeds without any prior authentication on the attacker's side, but requires user interaction. Because the affected context is a WooCommerce administrative interface, successful exploitation can expose sensitive order data, session cookies, and administrative controls. See the Patchstack WordPress Plugin Vulnerability advisory for additional technical detail.

Root Cause

The root cause is missing or insufficient output encoding of request parameters before they are embedded in HTML responses. The plugin echoes user-supplied values without applying WordPress-native escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows attacker-controlled markup and script tags to be interpreted by the victim's browser.

Attack Vector

Exploitation occurs remotely over the network. The attacker crafts a URL targeting a vulnerable endpoint exposed by the sms-alert plugin and delivers it via phishing email, chat message, or a malicious website. When the victim visits the link while authenticated to the WordPress site, the reflected payload executes with the victim's browser privileges. The scope-changed nature of the flaw means the injected script can access resources beyond the immediately vulnerable component.

No verified proof-of-concept code has been published. The vulnerability follows standard reflected XSS mechanics: injection of a payload such as a <script> tag or event handler attribute within a reflected query parameter or form field processed by the plugin.

Detection Methods for CVE-2025-26984

Indicators of Compromise

Web server access logs containing suspicious query strings with URL-encoded <script>, onerror=, onload=, or javascript: sequences targeting plugin endpoints under /wp-content/plugins/sms-alert/
Unexpected outbound requests from administrator browsers to external domains shortly after clicking inbound links
New or modified WordPress administrator accounts created without a corresponding legitimate change record

Detection Strategies

Inspect HTTP request logs for reflected parameters containing HTML or JavaScript syntax reaching plugin URLs
Deploy a web application firewall rule set that identifies XSS payload patterns targeting WordPress plugin parameters
Correlate referrer headers with administrator session activity to identify links originating from external, untrusted sources

Monitoring Recommendations

Enable and centralize WordPress audit logging for administrative actions, focusing on user creation, plugin edits, and option changes
Monitor browser Content Security Policy (CSP) violation reports for the WordPress admin origin
Track plugin version inventory across all managed WordPress sites to identify hosts still running sms-alert at or below version 3.7.8

How to Mitigate CVE-2025-26984

Immediate Actions Required

Update the SMS Alert Order Notifications plugin to a version above 3.7.8 as soon as the vendor publishes a fixed release
If no patched version is available, deactivate and remove the sms-alert plugin from all affected WordPress sites
Force password resets and session invalidation for any WordPress administrators who may have interacted with suspicious links

Patch Information

The Patchstack advisory lists all versions up to and including 3.7.8 as affected. Administrators should consult the plugin's WordPress.org listing and vendor communications to confirm the fixed version and apply it through the WordPress plugin update mechanism.

Workarounds

Deploy a web application firewall with WordPress-specific rulesets to filter reflected XSS payloads targeting plugin parameters
Implement a strict Content Security Policy on WordPress admin pages that disallows inline scripts and restricts script sources to trusted origins
Restrict WordPress administrative access to known IP ranges via server or firewall rules to reduce phishing exposure

bash

# Example nginx rule to block common reflected XSS payloads targeting the plugin
location ~* /wp-content/plugins/sms-alert/ {
    if ($args ~* "(<|%3C)script") { return 403; }
    if ($args ~* "(javascript:|onerror=|onload=)") { return 403; }
}