Input validation vulnerability in WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc 6.1.4

The WP SMS plugin for WordPress, up to and including version 6.1.4, is vulnerable to a type of attack called Reflected Cross-Site Scripting. This type of attack happens when an attacker injects malicious code into a website. In this case, the malicious code is injected through a parameter called ‘delete_mobile’ on the plugin. When a user visits a page with the injected code, the malicious code will execute, potentially allowing the attacker to access the user’s information. To prevent this type of attack, it is important to ensure that input is sanitized and output is escaped.