PT-2026-42072 · WordPress · Vatansms Wp Sms

Julian Chibuike Nwadinobi + 1 · CVE-2026-7462 · Published 2026-05-20 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VatanSMS WP SMS versions prior to 1.02

Description The VatanSMS WP SMS plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute if an administrator is tricked into clicking a malicious link. The issue is triggered via the page parameter.

Recommendations Update to a version later than 1.01. As a temporary workaround, restrict or sanitize the input received by the page parameter to prevent the execution of arbitrary scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7462

Affected Products

Vatansms Wp Sms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-7462 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/96ef8459-1600-4ca0-93c6-0ee42f8adabd?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-sms-vatansms-com/trunk/includes/admin/groups/groups.php#L34 · Note
• https://plugins.trac.wordpress.org/browser/wp-sms-vatansms-com/trunk/includes/admin/outbox/outbox.php#L5 · Note
• https://reddit.com/r/StopBadBots/comments/1tqd1k6/critical_38_plugins_no_fix_no_mercy_if_youve_got · Reddit Post
• https://plugins.trac.wordpress.org/browser/wp-sms-vatansms-com/trunk/includes/admin/subscribers/subscribers.php#L128 · Note
• https://t.me/CVEtracker/54320 · Telegram Post